HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedFinancial accountPIILowContained

AthleteTrax LLC

bd_568549374640bb19 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 19, 2024

Filed

Apr 26, 2024

To disclose

14 weeks

Affected

16state residents only

Linked

2 filings

Confidence

66%

Full breach record for AthleteTrax LLC →2 incidents on file

AthleteTrax LLC notified New Hampshire residents of a data breach involving unauthorized access to its sports management application. Between September 25, 2023, and January 19, 2024, an actor installed code to scrape credit card payment data. 16 NH residents were notified on April 26, 2024. The FBI was notified, and the company implemented safeguards.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 116 days

discovery → filing · 14 weeks / 98 days

Sep 25, 2023

Begins

Jan 19, 2024

Discovered

Apr 26, 2024

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_195583d6c0d7560c2024-04-26Verified

Name: AthleteTrax LLC
norm: athletetrax

Name: AthleteTrax LLC
norm: athletetrax
Industry: Technologyllm

Discovered: Jan 19, 2024
Breach occurred: Sep 25, 2023 – Jan 19, 2024
Undetected for: 116 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 26, 2024
Affected individuals: 16state-resident count only
Data types: Financial accountPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: Notified relevant regulatory authoritiesNotified the Federal Bureau of Investigation
Initial access: exploit_public_facing

During the incident: Investigated and responded to the incident
Assessed the security of AthleteTrax application and related systems
Identified the potentially involved data
Notified the AthleteTrax clients associated with this data
Verified and enriched the data for purposes of providing notice to potentially impacted individuals
Notified relevant regulatory authorities
Notified the Federal Bureau of Investigation
Changes made: Working to implement additional technical and administrative safeguards
Reviewing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGApr 26 · first

New Hampshire State AGApr 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/athletetrax-20240426.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 26, 2024
Raw hash: 4fb03bcd97c4b711346ba35dfa4ad44212e45700de2d1e32d56d12bbbde7b54f

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAthleteTrax LLC

Victim entityAthleteTrax LLC

Incidentdiscovered Jan 19, 2024

Stated responseInvestigated and responded to the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov