HackingTechnologyFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedData ExfiltratedDelayed DiscoveryPIIIDENTITY_GOVERNMENTFINANCIALIDENTITY_BASICMediumContained
INTUIT INC.
bd_2dd3ac8e8daf3f44 · schema v1 · pii pii-v1
Full breach record for INTUIT INC. →Intuit Inc. (TurboTax) notified Maine AG of an unauthorized account access incident affecting 1 Maine resident. An external party used stolen credentials obtained from a non-Intuit source to log into the victim's TurboTax account on 2024-02-26, potentially accessing tax return data including name, SSN, address, date of birth, driver's license number, and financial information. The breach was discovered 2025-02-04. Intuit locked the account and offered 12-month Experian IdentityWorks monitoring.
Maine clockDiscovered Feb 4, 2025 → Filed with AG Mar 5, 202529d ✓ ME AG ≤30d29 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_34c22d183b5a8ec9Maryland State AGfiled 2025-03-13(8d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2262ff1e-2d57-4ba2-b225-b8a51352fea2.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 5, 2025
- Raw hash
- 9aa0e867510608b5529b0246e4b6b993f3cd93aeb4d81c63cef97b6aee912df7
Reporting entity
- Name
- INTUIT INC.norm: intuit
- Domain
- intuit.com
- Industry
- Other Commercial
Victim entity
- Name
- INTUIT INC.norm: intuit
- Domain
- intuit.com
- Industry
- Other Commercial
- Industry
- TechnologyllmFinancial Servicesllm
Incident
- Discovered
- Feb 4, 2025
- Materiality determined
- —
- Notification sent
- Mar 5, 2025
- Affected individuals
- 1
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIALIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1110 Brute Force
- Threat actor
- ExternalFinancial
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 29 days(29 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 29d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 4, 2025→ Filed with AG: Mar 5, 202529d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.