HackingFinancial ServicesTechnologyFinanceCapture Stored DataData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

illumifin

bd_4f85d73db2552a71 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 4, 2025

Filed

Mar 31, 2026

To disclose

21 weeks

Affected

Not disclosed

Linked

12 filings

Confidence

65%

Full breach record for illumifin →

On November 4, 2025, illumifin Corporation identified unusual network activity and contained unauthorized access. An investigation determined an unauthorized person accessed the network and acquired copies of files containing client information. The company engaged forensic investigators, notified law enforcement, and implemented additional safeguards. Affected individuals were notified in February 2026.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 4, 2025 → Notified Feb 25, 2026113d ✗ CA 60-day late21 weeks discovery → filing

Incident timeline

discovery → filing · 21 weeks / 147 days

Nov 4, 2025

Begins

Nov 4, 2025

Discovered

Mar 31, 2026

Filed

vs. sector median

+13 wks slower

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_13235aa3216392ba2026-03-31Verified
Montana State AGbd_4834a8e85a0c3a7b2026-03-31Verified
Indiana State AGbd_61ed61057416aef12026-03-31Verified
New Hampshire State AGbd_6bd728330d6299662026-03-31Verified

Show 6 more filings ↓up to 22d gap

Texas State AGbd_89959561b8e6cb302026-04-02 · +2dVerified
South Carolina State AGbd_e3b9b22227324eae2026-04-07 · +7dVerified
Nebraska State AGbd_4fe7e34d290fb03a2026-03-13 · +18dVerified
HHS OCRbd_302d552bb1288e6f2026-03-10 · +21dVerified
New Hampshire State AGbd_45251292f85141d12026-04-22 · +22dVerified
Oregon State AGbd_c525393ebdb287142026-04-22 · +22dVerified

Showing first 10 of 11 linked disclosures.

Name: illumifin
Domain: illumifin.com

Name: illumifin
Domain: illumifin.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Nov 4, 2025
Breach occurred: Nov 4, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified law enforcement

During the incident: Implemented incident response protocols
Took steps to contain the activity
Launched an investigation with assistance from a third-party forensic firm
Notified law enforcement
Conducted a comprehensive review and analysis of the files
Implemented additional safeguards to further protect and monitor our systems
Changes made: Implemented additional safeguards to further protect and monitor our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(147 days from discovery to filing)
Compliance flags: CA 60-day late · 113dCA AG copy >15d · 34d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 4, 2025
→ Notified: Feb 25, 2026
113d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Feb 25, 2026
→ AG copy submitted: Mar 31, 2026
34d 15 calendar days CA AG copy >15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 4, 2025 → Notified: Feb 25, 2026	113d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Feb 25, 2026 → AG copy submitted: Mar 31, 2026	34d	15 calendar days	CA AG copy >15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

HHS OCRMar 10 · first

Nebraska State AG+3d

Massachusetts State AG+21d

Montana State AG+21d

Indiana State AG+21d

New Hampshire State AG+21d

California State AG+21d · this page

Texas State AG+23d

South Carolina State AG+28d

New Hampshire State AG+43d

Oregon State AG+43d

Pattern: first filing Mar 10 (MN), last Apr 22 (OR) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-621109
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 31, 2026
Raw hash: c658ec1d1c5a24dda26c0ea93c27902214288f2606e5d230a084cf3b3cf8decd

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityillumifin

Victim entityillumifin

Incidentdiscovered Nov 4, 2025

Stated responseImplemented incident response protocols

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov