HackingTechnologyFinancial ServicesInformationSkimmerCapture Stored DataCustomer Data InvolvedData ExfiltratedPCIFinancial accountFinancial credentialsIdentity (basic)LowContained

InvoiceCloud

bd_41688672135d043c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 16, 2025

Filed

Jul 16, 2025

To disclose

4 weeks

Affected

20state residents only

Linked

5 filings

Confidence

66%

Full breach record for InvoiceCloud →

InvoiceCloud, Inc. identified unauthorized code (likely a skimmer) on customer payment websites on June 16, 2025. The incident affected approximately 20 New Hampshire residents, exposing names, billing addresses, emails, payment card numbers, expiration dates, and CVVs. The company removed the code, engaged forensics, notified law enforcement, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Jun 16, 2025

Begins

Jun 16, 2025

Discovered

Jul 16, 2025

Filed

vs. sector median

14 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_0f427a53a9556e142025-07-16Verified
Vermont State AGbd_72c05a49298b8e952025-07-16Verified
Maine State AGbd_83a6de7d7eecefa42025-07-16Verified
Nebraska State AGbd_bc6e60159c3eebc62025-07-16Verified

Name: InvoiceCloud
norm: invoicecloud
Domain: invoicecloudservice.com

Name: InvoiceCloud
norm: invoicecloud
Domain: invoicecloudservice.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Jun 16, 2025
Breach occurred: Jun 16, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2025
Affected individuals: 20state-resident count only
Data types: PCIFinancial accountFinancial credentialsIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Promptly took steps to stop and remediate the issue
Engaged a forensic firm to investigate
Notified law enforcement
Removed the unauthorized script
Continues to perform additional monitoring for all customers
Changes made: Enhanced and deployed additional safeguards on its systems
Reinforced security and network processes and procedures
Reviewed systems to enhance security monitoring and controls
Offering one year of complimentary credit monitoring and identity restoration services through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 16 · first

Vermont State AGJul 16 · first

Maine State AGJul 16 · first

Nebraska State AGJul 16 · first

New Hampshire State AGJul 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/invoicecloud-20250716.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2025
Raw hash: 882cf5fc0f825bb62f2c522db370088c431a4849b75caf85f7cbf4ac286cd79d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityInvoiceCloud

Victim entityInvoiceCloud

Incidentdiscovered Jun 16, 2025

Stated responsePromptly took steps to stop and remediate the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov