HackingTechnologyInformationVulnerability ExploitData ExfiltratedTargetedIdentity (basic)MediumContained

TOO LOST LLC

bd_54386167de42a993 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 10, 2026

Filed

Feb 20, 2026

To disclose

10 days

Affected · nationwide

3,2062 in this filing

Linked

10 filings

Confidence

65%

Full breach record for TOO LOST LLC →

Too Lost LLC reported an external system breach (hacking) affecting 3,206 individuals, including 2 Maine residents. Unauthorized access to a web application occurred between July 25 and September 2, 2025. The incident was discovered on February 10, 2026. Affected data included names and basic contact information. The company engaged cybersecurity experts and law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 10, 2026 → Filed with AG Feb 20, 202610d ✓ ME AG ≤30d10 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 200 days

discovery → filing · 10 days

Jul 25, 2025

Begins

Feb 10, 2026

Discovered

Feb 20, 2026

Filed

vs. sector median

17 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Vermont State AGbd_0879145c47f3fbf52026-02-20Verified
California State AGbd_2d71718d265351de2026-02-20Candidate
Indiana State AGbd_32c22f44949121742026-02-20Verified by operator
New Hampshire State AGbd_373b6de6cb19f9512026-02-20Verified

Show 5 more filings ↓up to 34d gap

Nebraska State AGbd_4ad7e3b0d8858b932026-02-20Verified
Indiana State AGbd_a10965c99e7afc612026-02-20Verified
Massachusetts State AGbd_b2c600e1387b37c42026-02-20Verified
Texas State AGbd_8bce7e39abf24b6e2026-03-16 · +24dVerified
New Hampshire State AGbd_979e794526725f7b2026-03-26 · +34dVerified

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com

Name: TOO LOST LLC
norm: too lost
Domain: toolost.com
Industry: Technologyllm

Discovered: Feb 10, 2026
Breach occurred: Jul 25, 2025 – Sep 2, 2025
Undetected for: 200 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 20, 2026
Affected individuals: 3,206state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation with the assistance of cybersecurity experts
Contacted law enforcement
Changes made: Provided access to identity protection services
Confirmed that the data was destroyed by the unauthorized third party
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 days(10 days from discovery to filing)
Compliance flags: ME AG ≤30d · 10d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 10, 2026
→ Filed with AG: Feb 20, 2026
10d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 10, 2026 → Filed with AG: Feb 20, 2026	10d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 8 states

View merged incident ↗

Vermont State AGFeb 20 · first

California State AGFeb 20 · first

Indiana State AGFeb 20 · first

New Hampshire State AGFeb 20 · first

Nebraska State AGFeb 20 · first

Indiana State AGFeb 20 · first

Massachusetts State AGFeb 20 · first

Maine State AGFeb 20 · first · this page

Texas State AG+24d

New Hampshire State AG+34d

Pattern: first filing Feb 20 (VT), last Mar 26 (NH) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c38e9a02-17f5-40b8-993a-48b55bc01c5f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2026
Raw hash: b8705bc0954536a4324928a268917cf1b92f9c45cd8b0ea4dd23044e6999385b

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityTOO LOST LLC

Victim entityTOO LOST LLC

Incidentdiscovered Feb 10, 2026

Stated responseLaunched a comprehensive investigation with the assistance of cybersecurity experts

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov