HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Edmunds.com, Inc.

bd_412502c6b35dee2a · schema v1 · pii pii-v2

Severity

Medium

Discovered

Oct 15, 2025

Filed

Nov 14, 2025

To disclose

—

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Edmunds.com, Inc. →

Edmunds.com, Inc. notified the Nebraska Attorney General of a data security incident involving its proprietary messaging application. Unauthorized activity occurred on or about August 19, 2025, detected on October 15, 2025. Approximately 1 Nebraska resident was potentially impacted, with data including names, Social Security numbers, credit card information, and driver's license information. Edmunds offered 24 months of credit monitoring services.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

undetected · 57 days

Aug 19, 2025

Begins

Oct 15, 2025

Discovered

Nov 14, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

A leak claim by shinyhunters about this victim predates this filing by 44 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_a284303f227591832025-09-30 · +45dVerified

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_f8fa20e85c9123042025-11-14Verified

Name: HOGAN LOVELLS US LLP
norm: hogan lovells us

Name: Edmunds.com, Inc.
norm: edmundscom
Industry: Technologyllm

Discovered: Oct 15, 2025
Breach occurred: Aug 19, 2025
Undetected for: 57 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 14, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Promptly launched a comprehensive investigation to assess the potential scope of the incident
Took steps to address the incident and further enhance security
Steps have been taken to further enhance safeguards designed to prevent unauthorized access
Arranged, at no cost to you, 24 months of credit monitoring services from IDX
Changes made: Implemented further security enhancements to help remediate the issue
Steps have been taken to further enhance safeguards designed to prevent unauthorized access
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGNov 14 · first

Nebraska State AGNov 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/b924bfb1-207a-40b6-99b1-a77e588399ed.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2025
Raw hash: c11f93fc070c18069712fcb8171431b8b4c602007c932d74f61b768bc7d09ba9

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityHOGAN LOVELLS US LLP

Victim entityEdmunds.com, Inc.

Incidentdiscovered Oct 15, 2025

Stated responsePromptly launched a comprehensive investigation to assess the potential scope of the incident

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov