HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

illumifin

bd_4fe7e34d290fb03a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 4, 2025

Filed

Mar 13, 2026

To disclose

—

Affected

3state residents only

Linked

12 filings

Confidence

67%

Full breach record for illumifin →

illumifin Corporation, an insurance technology company, notified Nebraska residents that on November 4, 2025, an unauthorized person gained access to its network and exfiltrated files containing names and Social Security numbers. Notification letters were mailed on March 13, 2026, to three Nebraska residents. illumifin offered credit monitoring and established a call center.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 4, 2025

Discovered

Mar 13, 2026

Filed

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

HHS OCRbd_302d552bb1288e6f2026-03-10 · +3dVerified
Massachusetts State AGbd_13235aa3216392ba2026-03-31 · +18dVerified
Montana State AGbd_4834a8e85a0c3a7b2026-03-31 · +18dVerified
California State AGbd_4f85d73db2552a712026-03-31 · +18dVerified

Show 6 more filings ↓up to 40d gap

Indiana State AGbd_61ed61057416aef12026-03-31 · +18dVerified
New Hampshire State AGbd_6bd728330d6299662026-03-31 · +18dVerified
Texas State AGbd_89959561b8e6cb302026-04-02 · +20dVerified
South Carolina State AGbd_e3b9b22227324eae2026-04-07 · +25dVerified
New Hampshire State AGbd_45251292f85141d12026-04-22 · +40dVerified
Oregon State AGbd_c525393ebdb287142026-04-22 · +40dVerified

Showing first 10 of 11 linked disclosures.

Name: illumifin
Domain: illumifin.com

Name: illumifin
Domain: illumifin.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Nov 4, 2025
Materiality determined: —
Notification sent: Mar 13, 2026
Affected individuals: 3state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Implemented its incident response protocols
Taking steps to contain the activity
Launching an investigation with assistance from a third-party forensic firm
Notified law enforcement
Changes made: Implemented, and will continue to adopt, additional safeguards to further protect and monitor its systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

HHS OCRMar 10 · first

Nebraska State AG+3d · this page

Massachusetts State AG+21d

Montana State AG+21d

California State AG+21d

Indiana State AG+21d

New Hampshire State AG+21d

Texas State AG+23d

South Carolina State AG+28d

New Hampshire State AG+43d

Oregon State AG+43d

Pattern: first filing Mar 10 (MN), last Apr 22 (OR) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/cf183ee1-8b41-4873-8a8f-52d8c3bb4932.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 13, 2026
Raw hash: c38425fe78feac03e8e4425031c0aa587540bd0795cf6ba4c80efe9a6f5bf7bc

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityillumifin

Victim entityillumifin

Incidentdiscovered Nov 4, 2025

Stated responseImplemented its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov