HackingTechnologyHealthcareInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)HighContained

Shiftster LLC

bd_366421f6b471efc5 · schema v1 · pii pii-v2

Severity

High

Discovered

Mar 12, 2025

Filed

Aug 8, 2025

To disclose

—

Affected · nationwide

3,6732 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Shiftster LLC →

Shiftster LLC (dba ESHYFT) disclosed a data security incident involving an unauthorized AWS S3 bucket access starting Jan 6, 2025. Discovered March 12, 2025, the breach affected up to 3,673 individuals, including names, DOB, addresses, VINs, driver's licenses, and health info. 94 individuals had SSN/DL impacted. Notifications mailed Aug 8, 2025. Shiftster secured the bucket and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 65 days

Jan 6, 2025

Begins

Mar 12, 2025

Discovered

Aug 8, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_60fc09f62fe686ca2025-08-27 · +19dCandidate
Massachusetts State AGbd_ace2ab60adfc2fa82025-10-17 · +70dVerified
Vermont State AGbd_ff21d2f05f75d28d2025-10-20 · +73dVerified
New Hampshire State AGbd_5cc76677f65bb4ba2025-10-22 · +75dVerified

Name: Pierson Ferdinand LLP
norm: pierson ferdinand
Domain: pierferd.com

Name: Shiftster LLC
norm: shiftster
Industry: TechnologyllmHealthcarellm

Discovered: Mar 12, 2025
Breach occurred: Jan 6, 2025
Undetected for: 65 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2025
Affected individuals: 3,673state + nationwide
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Initial access: exploit_public_facing

During the incident: Secured the AWS bucket at issue
Interfaced with the “cyber security investigator” to confirm the deletion of the data
Worked with cybersecurity counsel to investigate how the Incident occurred
Removed the sensitive data from within the S3 bucket
Making the bucket private
Offered complimentary identity theft and credit monitoring services for one year
Changes made: Strengthen its security posture
Removing the sensitive data from within the S3 bucket
Making the bucket private
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Nebraska State AGAug 8 · first · this page

Indiana State AG+19d

Massachusetts State AG+70d

Vermont State AG+73d

New Hampshire State AG+75d

Pattern: first filing Aug 8 (NE), last Oct 22 (NH) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/ace6db08-7e75-42f5-a81f-7cd39a95d826.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 8, 2025
Raw hash: afbbff821da276b0ce7aa393686aaf7fbeeba2891f6f954fe6c75aac575a215c

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPierson Ferdinand LLP

Victim entityShiftster LLC

Incidentdiscovered Mar 12, 2025

Stated responseSecured the AWS bucket at issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov