HackingStolen CredentialsCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained

INTUIT INC.

bd_3061f0989ea6c41d · schema v1 · pii pii-v1

Full breach record for INTUIT INC. →

Intuit, Inc. notified the New Hampshire Attorney General of unauthorized access to a single New Hampshire TurboTax customer's account. The incident was discovered on April 9, 2025, following a security review. The unauthorized access occurred between January 21, 2025, and April 8, 2025, using legitimate credentials obtained from non-Intuit sources. Intuit secured the account, notified the IRS, and sent a notice to the affected resident offering free identity protection and credit monitoring services.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

bd_5a0afa40c3cf3d53Maine State AGfiled 2025-05-09Candidate
bd_b890392374b99708Indiana State AGfiled 2025-05-09Verified

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/intuit-20250509.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 9, 2025
Raw hash: 477c5519450664098296096fb081187bbbf2013dd7ae56e1c9122a19aeee0117

Reporting entity

Name: INTUIT INC.
norm: intuit
Domain: intuit.com

Victim entity

Name: INTUIT INC.
norm: intuit
Domain: intuit.com

Incident

Discovered: Apr 9, 2025
Materiality determined: —
Notification sent: May 9, 2025
Affected individuals: 1
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the IRS
Initial access: valid_credentials

Compliance

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.