HackingTechnologyFinancial ServicesInformationStolen CredentialsData ExfiltratedTargetedIdentity (basic)LowContained

AvidXchange, Inc.

bd_3a8108eae608cad6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 1, 2023

Filed

Oct 13, 2023

To disclose

28 weeks

Affected

1state residents only

Linked

9 filings

Confidence

65%

Full breach record for AvidXchange, Inc. →

AvidXchange, Inc. notified individuals of a cybersecurity incident detected in April 2023. Threat actors extracted personal information (names and variable data) and published data sets in May 2023. AvidXchange engaged forensic experts, notified law enforcement, and expelled the actor. Remediation included enhanced access controls and virtual desktop deployment. Identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 28 weeks / 195 days

Apr 1, 2023

Begins

Apr 1, 2023

Discovered

Oct 13, 2023

Filed

vs. sector median

+9 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (4)

Leak Siteabyssbd_3c63ece236c48fd82023-05-08 · +158dVerified by operator
Leak Siteabyssbd_baa8feeb7cc908962023-05-04 · +162dVerified by operator
Leak Siteransomhousebd_1e64d38531f685fe2023-05-02 · +164dVerified by operator
Leak Sitecl0pbd_e251651648d5fbad2023-03-16 · +211dVerified by operator

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_237b163f1c22975c2023-10-13Verified by operator
Indiana State AGbd_39dc9644865ee5612023-10-13Verified
Maine State AGbd_70bfa9f1fdb9ae572023-10-13Verified by operator
Maine State AGbd_300240bb0d41a1db2023-12-10 · +58dVerified by operator

Name: AvidXchange, Inc.
norm: avidxchange
Domain: avidxchange.com

Name: AvidXchange, Inc.
norm: avidxchange
Domain: avidxchange.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Apr 1, 2023
Breach occurred: Apr 1, 2023 – Apr 30, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 13, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched an investigation with the support of leading cybersecurity experts
Reached out to law enforcement
Expelled the threat actor from our systems
Accelerated our planned security enhancements
Changes made: Establishing separate, cloud-based user accounts to further limit and restrict the capabilities of privileged accounts
Implementing additional logging processes and imposing more restrictions to limit access to sensitive systems
Updating user access controls to require smart, context-dependent authentication
Modifying firewall settings to further restrict inbound and outbound access to our environments
Deploying a new, highly secured virtual desktop environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(195 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 13 · first

Indiana State AGOct 13 · first

Maine State AGOct 13 · first

Montana State AGOct 13 · first · this page

Maine State AG+58d

Pattern: first filing Oct 13 (MA), last Dec 10 (ME) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-768.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2023
Raw hash: ebe5a18d9374509c11edad5a966d2fc36735d3454eb4d54331b489600f10ba91

Linked disclosures

Ransomware claims (4)

Regulatory filings (4) · sorted by filing gap

Reporting entityAvidXchange, Inc.

Victim entityAvidXchange, Inc.

Incidentdiscovered Apr 1, 2023

Stated responseLaunched an investigation with the support of leading cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov