HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)MediumContained

Transak, Inc.

bd_3419009e5cf78b81 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 23, 2024

Filed

Feb 28, 2025

To disclose

23 weeks

Affected · nationwide

23,11375 in this filing

Linked

9 filings

Confidence

67%

Full breach record for Transak, Inc. →

Transak USA LLC notified the NH AG of a data breach impacting 23,113 customers, including 75 NH residents. On Sept 23, 2024, the company learned an employee's credentials were compromised, allowing unauthorized access to a third-party data host. Data was acquired and later published by the actor. Transak engaged CrowdStrike and law enforcement, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 23 weeks / 158 days

Sep 23, 2024

Discovered

Feb 28, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Maine State AGbd_35bc83b8aa1b49e72025-02-28Verified
Massachusetts State AGbd_619075abbd17214f2025-02-28Verified
Vermont State AGbd_761ade3211135d852025-02-28Verified
Maryland State AGbd_81c6f6b6647441e32025-02-28Verified

Show 4 more filings ↓up to 27d gap

Nebraska State AGbd_99a52dda14286cba2025-02-28Verified
Indiana State AGbd_ade85d7f854c66812025-02-28Verified
California State AGbd_ffe97878a4cef6862025-02-28Candidate
Illinois State AGbd_7dd9285bbbc45fe02025-02-01 · +27dVerified

Name: Transak, Inc.
norm: transak

Name: Transak, Inc.
norm: transak
Industry: Financial ServicesllmTechnologyllm

Discovered: Sep 23, 2024
Materiality determined: —
Notification sent: Feb 21, 2025
Affected individuals: 23,113state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified global law enforcement agencies, including the Department of Homeland Security and the FBI
Initial access: valid_credentials

During the incident: Retained a leading IT forensic firm – CrowdStrike
Retained legal counsel (Kennedys)
Contacted the data host and requesting evidence of proof from the actor
Notified global law enforcement agencies, including the Department of Homeland Security and the FBI
Notifying the individuals whose PII was impacted
Offering complimentary credit monitoring services
Changes made: Enforcing hardware-based MFA for accessing third-party vendor platforms where sensitive data is stored
Implementing VPN security enhancements
Improving EDR monitoring, including with its KYC vendor
Implementing endpoint security upgrades
Updated its access privilege modules
Requiring more frequent security audits of its third-party vendors
Implementing employee training to mitigate the risk of another cybersecurity event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGFeb 1 · first

Maine State AG+27d

Massachusetts State AG+27d

Vermont State AG+27d

Maryland State AG+27d

Nebraska State AG+27d

Indiana State AG+27d

California State AG+27d

New Hampshire State AG+27d · this page

Pattern: first filing Feb 1 (IL), last Feb 28 (NH) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/transak-usa-20250228.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2025
Raw hash: cffdc334a2c534cabb14f040a88c988d79a384be01c67c16edab6f9cc5246c46

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTransak, Inc.

Victim entityTransak, Inc.

Incidentdiscovered Sep 23, 2024

Stated responseRetained a leading IT forensic firm – CrowdStrike

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov