HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedCredentialsIdentity (basic)Financial accountLowContained

FloatMe

bd_5fe9f30c230423fd · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 9, 2025

Filed

Jan 6, 2026

To disclose

28 days

Affected

2state residents only

Linked

4 filings

Confidence

66%

All records for FloatMe →

Account takeover notice

FloatMe notified users of unauthorized access to their accounts. The filing says: “On December 8, 2025, a malicious actor attempted to improperly access user accounts through login credentials obtained from an unknown non-FloatMe source.”

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 28 days

Dec 8, 2025

Begins

Dec 9, 2025

Discovered

Jan 6, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_54811d05a129f6e32026-01-06Verified
Maine State AGbd_cb846b9a1a7759902026-01-06Verified
Indiana State AGbd_0823ece498a904e32026-01-05 · +1dCandidate

Name: FloatMe
norm: floatme

Name: FloatMe
norm: floatme
Industry: Financial Servicesllm

Discovered: Dec 9, 2025
Account access: Dec 8, 2025 – Dec 9, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 6, 2026
Affected individuals: 2state-resident count only
Data types: CredentialsIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1110 Brute ForceT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Reported the incident to Auth0
Directed Auth0 to shut down the endpoint
Reset the passwords of the impacted New Hampshire residents
Notified impacted residents of the need to reauthenticate their accounts and select a new password
Cancelled any advances that were fraudulently initiated from impacted accounts
Changes made: Shut off platform access to the malicious actor through technical safeguards
Recommended that consumers implement multifactor authentication (MFA) through the mobile app
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJan 5 · first

Massachusetts State AG+1d

Maine State AG+1d

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/floatme-20260106.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2026
Raw hash: f5963018e24e92bab3085ddfada3f4531f3e287387dabbec989a6630be65b992

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFloatMe

Victim entityFloatMe

Incidentdiscovered Dec 9, 2025

Stated responseReported the incident to Auth0

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov