HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedCREDENTIALSIDENTITY_BASICFINANCIAL_ACCOUNTLowContained

FloatMe

bd_5fe9f30c230423fd · schema v1 · pii pii-v1

FloatMe, Corp. notified the New Hampshire Attorney General of a credential stuffing incident involving its Auth0 platform. The breach occurred December 8-9, 2025, affecting 2 New Hampshire residents. Exposed data included login credentials, mailing addresses, phone numbers, partial bank/debit card numbers, and recent financial transactions. FloatMe reset passwords, shut down the compromised endpoint, and cancelled fraudulent advances. Notifications were sent to affected individuals on January 6, 2026.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

bd_cb846b9a1a775990Maine State AGfiled 2026-01-06Verified
bd_0823ece498a904e3Indiana State AGfiled 2026-01-05(1d gap)Candidate

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/floatme-20260106.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2026
Raw hash: f5963018e24e92bab3085ddfada3f4531f3e287387dabbec989a6630be65b992

Reporting entity

Name: FloatMe
norm: floatme

Victim entity

Name: FloatMe
norm: floatme

Incident

Discovered: Dec 9, 2025
Materiality determined: —
Notification sent: Jan 6, 2026
Affected individuals: 2
Data types: CREDENTIALSIDENTITY_BASICFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110 Brute ForceT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Office of the Attorney General
Initial access: valid_credentials

Compliance

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.