HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumActive
InStream, LLC
bd_3b7e6e47d117ec02 · schema v1 · pii pii-v1
Full breach record for InStream, LLC →InStream, LLC notified the New Hampshire Attorney General of a data event affecting 9 NH residents. An unknown actor accessed systems in the Buffalo office between July 20-25, 2024, copying files containing names, SSNs, and government IDs. InStream detected performance issues in July 2024, began notifying individuals in October 2024, and filed this notice on June 4, 2025. The investigation is ongoing.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_ad3d1915dde1c4fcVermont State AGfiled 2025-06-04Candidate
- bd_b8bbef54fff5d39bIndiana State AGfiled 2025-06-04Verified
- bd_b9e96871cb663a8aMaine State AGfiled 2025-06-04Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/instream-20250604.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 4, 2025
- Raw hash
- 086ccc2323f4dfa596c39be69c3c19b6685aa63276fd34000870b99c4dccf2ef
Reporting entity
- Name
- InStream, LLCnorm: instream
- Domain
- instreamllc.com
Victim entity
- Name
- InStream, LLCnorm: instream
- Domain
- instreamllc.com
Incident
- Discovered
- Jul 20, 2024
- Materiality determined
- Apr 23, 2025
- Notification sent
- Oct 16, 2024
- Affected individuals
- 9
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified law enforcementProviding written notice of the Event to relevant state and federal regulatorsNotifying the three major credit reporting agencies, Equifax, Experian, and TransUnion
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 46 weeks(319 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.