HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

21 Air, LLC

bd_6b60b566af0e70ba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 3, 2025

Filed

Dec 15, 2025

To disclose

28 weeks

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for 21 Air, LLC →

21 Air, LLC notified the New Hampshire Attorney General of a cybersecurity incident discovered on June 3, 2025, involving unauthorized access to a single employee email account. The investigation determined that information for 2 New Hampshire residents was potentially accessed, including names, Social Security numbers, and government IDs. 21 Air engaged third-party specialists, reported the incident to CISA, and sent notices to affected individuals on December 11, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 28 weeks / 195 days

Jun 3, 2025

Discovered

Dec 15, 2025

Filed

vs. sector median

+9 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_b3a25e188339e5cb2025-12-15Verified
Massachusetts State AGbd_57ccb4f510435ad72025-12-18 · +3dVerified
Indiana State AGbd_144ddf00b9510f412025-12-11 · +4dCandidate
Nebraska State AGbd_2cb773ff4e6045602025-12-11 · +4dVerified

Name: Cipriani
norm: cipriani
Domain: cipriani.com

Name: 21 Air, LLC
norm: 21 air
Domain: 21air.us
Industry: Technologyllm

Discovered: Jun 3, 2025
Materiality determined: —
Notification sent: Dec 11, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to the Cybersecurity and Infrastructure Security Agency (“CISA”)
Initial access: valid_credentials

During the incident: Took swift action to secure its email system and network
Reported this incident to the Cybersecurity and Infrastructure Security Agency (“CISA”)
Began working with third-party computer specialists to investigate the full nature and scope of the incident
Engaged third-party forensic specialists to investigate this matter
Sent written notice of this incident to the potentially impacted New Hampshire residents
Changes made: Offered complimentary credit monitoring and identity theft protection services for twelve (12) months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(195 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 11 · first

Nebraska State AGDec 11 · first

Maine State AG+4d

New Hampshire State AG+4d · this page

Massachusetts State AG+7d

Pattern: first filing Dec 11 (IN), last Dec 18 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/21-air-20251215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2025
Raw hash: 0f2f286b64e84fd7425cad252f3cafb119def232ffc1a013685abf9810b2c521

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityCipriani

Victim entity21 Air, LLC

Incidentdiscovered Jun 3, 2025

Stated responseTook swift action to secure its email system and network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov