HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Bitcoin Depot Inc.
bd_39a3aa427658f320 · schema v1 · pii pii-v1
Full breach record for Bitcoin Depot Inc. →Bitcoin Depot, Inc. notified 20 New Hampshire residents of a data security incident detected on June 23, 2024. Unauthorized access resulted in the exfiltration of customer names, phone numbers, driver's license numbers, and potentially addresses, DOBs, and emails. Notification was delayed at the request of federal law enforcement until June 13, 2025. Notices mailed July 8, 2025.
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_a4cb033b61a835dfCalifornia State AGfiled 2025-07-07Verified
- bd_c8e4dfe81f19909fWashington State AGfiled 2025-07-07Candidate
- bd_d025a49725576809Maine State AGfiled 2025-07-07Verified
- bd_6665603a5e4b86d9Texas State AGfiled 2025-07-08(1d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 1d gap
- bd_ccd7536ef7afb0dcIndiana State AGfiled 2025-07-08(1d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bitcoin-depot-20250707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 7, 2025
- Raw hash
- 4598f5c28663364861416396acdb082fefb41ca1f4b22675d42878cbd65caaa1
Reporting entity
- Name
- Bitcoin Depot Inc.norm: bitcoin depot
- Domain
- bitcoindepot.com
Victim entity
- Name
- Bitcoin Depot Inc.norm: bitcoin depot
- Domain
- bitcoindepot.com
Incident
- Discovered
- Jun 23, 2024
- Materiality determined
- Jul 18, 2024
- Notification sent
- Jul 8, 2025
- Affected individuals
- 20
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney GeneralFederal law enforcement requested delay in notification
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 13 months(379 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.