illumifin
bd_45251292f85141d1 · schema v1 · pii pii-v1
Full breach record for illumifin →illumifin Corporation, an insurance technology company, filed a supplemental notification with the New Hampshire Attorney General regarding a security incident discovered on November 4, 2025. An unauthorized individual accessed the network and exfiltrated files containing customer PII, including SSNs, driver's license numbers, financial account numbers, and medical/health insurance information. The breach affected 37 New Hampshire residents. illumifin engaged forensic investigators, notified law enforcement, and provided credit monitoring services to affected individuals. Notification letters were mailed starting March 31, 2026.
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_c525393ebdb28714Oregon State AGfiled 2026-04-22Verified
- bd_89959561b8e6cb30Texas State AGfiled 2026-04-02(20d gap)Verified
- bd_61ed61057416aef1Indiana State AGfiled 2026-03-31(22d gap)Candidate
- bd_6bd728330d629966New Hampshire State AGfiled 2026-03-31(22d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/illumifin-20260422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 22, 2026
- Raw hash
- db3cc1b1c4e83d0b205a10650a5c033a1c9c9c64349e35dd0af94861d59e2693
Reporting entity
- Name
- illumifin
- Domain
- illumifin.com
Victim entity
- Name
- illumifin
- Domain
- illumifin.com
Incident
- Discovered
- Nov 4, 2025
- Materiality determined
- —
- Notification sent
- Mar 31, 2026
- Affected individuals
- 37
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Supplemental Incident Notification to New Hampshire Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 24 weeks(169 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.