HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

INTUIT INC.

bd_3061f0989ea6c41d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 9, 2025

Filed

May 9, 2025

To disclose

4 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for INTUIT INC. →72 incidents on file

Intuit, Inc. notified the New Hampshire Attorney General of unauthorized access to a single New Hampshire TurboTax customer's account. The incident was discovered on April 9, 2025, following a security review. The unauthorized access occurred between January 21, 2025, and April 8, 2025, using legitimate credentials obtained from non-Intuit sources. Intuit secured the account, notified the IRS, and sent a notice to the affected resident offering free identity protection and credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 78 days

discovery → filing · 4 weeks / 30 days

Jan 21, 2025

Begins

Apr 9, 2025

Discovered

May 9, 2025

Filed

vs. sector median

14 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_5a0afa40c3cf3d532025-05-09Candidate
Massachusetts State AGbd_8820c1ae3b434c902025-05-09Verified
Indiana State AGbd_b890392374b997082025-05-09Verified

Name: INTUIT INC.
norm: intuit
Domain: intuit.com

Name: INTUIT INC.
norm: intuit
Domain: intuit.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Apr 9, 2025
Breach occurred: Jan 21, 2025 – Apr 8, 2025
Undetected for: 78 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 9, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the IRS
Initial access: valid_credentials

During the incident: Conducted an investigation
Took steps to secure the customer’s account and information
Notified the IRS
Sent notice to the affected New Hampshire resident
Offered identity protection and credit monitoring services free of charge
Changes made: Recommended enabling two-step verification upon every login
Recommended changing passwords for non-Intuit online accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGMay 9 · first

Massachusetts State AGMay 9 · first

Indiana State AGMay 9 · first

New Hampshire State AGMay 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/intuit-20250509.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2025
Raw hash: 477c5519450664098296096fb081187bbbf2013dd7ae56e1c9122a19aeee0117

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityINTUIT INC.

Victim entityINTUIT INC.

Incidentdiscovered Apr 9, 2025

Stated responseConducted an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov