HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICCREDENTIALSLowContained
TaxBit
bd_131b3c7c00a264f4 · schema v1 · pii pii-v1
Full breach record for TaxBit →TaxBit notified consumers of a data security incident involving a third-party web application. Unauthorized access may have occurred in late September 2023, potentially exposing names, email addresses, and read-only API keys. TaxBit engaged outside experts, notified impacted users on September 23, 2023, and recommended deleting and recreating API keys. No specific count of affected individuals was provided in the filing.
Vermont clock✗ VT AG >45 bday12 weeks discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-12-19-taxbit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 19, 2023
- Raw hash
- 5e35fc603f371960303ee918af4b4ea8925ffa14937d2e8f4c73844fc0c7bdcd
Reporting entity
- Name
- TaxBitnorm: taxbit
Victim entity
- Name
- TaxBitnorm: taxbit
Incident
- Discovered
- Sep 23, 2023
- Materiality determined
- —
- Notification sent
- Sep 23, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- External
- Initial access
- supply_chain
Compliance
- Time to disclose
- 12 weeks(87 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.