HackingOtherCustomer Data InvolvedPIIIdentity (basic)LowContained

Inca Floats

bd_5c074a411cc4b47a · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 24, 2024

Filed

Mar 21, 2025

To disclose

17 weeks

Affected

1state residents only

Linked

5 filings

Confidence

67%

Full breach record for Inca Floats →

Inca Floats, Inc. (dba International Nature & Cultural Adventures) reported a November 2024 data security incident where an unauthorized third party attempted to infiltrate its network. The company detected the incident on November 24, 2024, secured its network, and engaged outside counsel. No data exfiltration was confirmed. One New Hampshire resident was potentially affected. The company offered free credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 17 weeks / 117 days

Nov 24, 2024

Discovered

Mar 21, 2025

Filed

vs. sector median

+9 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_05de7c13f9f2aa242025-01-21 · +59dVerified
Maine State AGbd_9fef5edf8df5518a2025-01-21 · +59dCandidate
Montana State AGbd_b2251ef4755d1f852025-01-21 · +59dVerified
Maryland State AGbd_db3136e3051410ea2026-04-23 · +398dVerified

Name: Inca Floats
norm: inca floats

Name: Inca Floats
norm: inca floats
Also named: Inca Floats, Inc.dba oflegal entity
International Nature & Cultural Adventuresdba oftrade name
Integrity Galapagosdba oftrade name
Industry: Otherllm

Discovered: Nov 24, 2024
Materiality determined: —
Notification sent: Jan 17, 2025
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: submitted its original notification letter to the New Hampshire Attorney General on January 21, 2025
Initial access: exploit_public_facing

During the incident: Patching the server
Deactivating compromised accounts
Changing passwords
Launched an investigation into the incident
Investigation was performed with help of outside counsel
Provided notice of the incident to its affected travel partners
Offer credit monitoring and protection services for each individual
Implement a call center that will assist individuals with questions
Changes made: Patching the server
Deactivating compromised accounts
Changing passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

New Hampshire State AGJan 21 · first

Maine State AGJan 21 · first

Montana State AGJan 21 · first

New Hampshire State AG+59d · this page

Maryland State AG+457d

Pattern: first filing Jan 21 (NH), last Apr 23 (MD) — a 457-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/inca-floats-international-nature-cultural-adventures-integrity-galapagos-20250321.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2025
Raw hash: 1d72c303c493fd5c6287c6b92fdc9c3f3403010cb2288226fca5cfd7ec04a919

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityInca Floats

Victim entityInca Floats

Incidentdiscovered Nov 24, 2024

Stated responsePatching the server

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov