HackingTechnologyFinancial ServicesInformationStolen CredentialsCustomer Data InvolvedWire FraudIdentity (basic)Financial accountLowContained

AmpUp

bd_7296064165221cde · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 25, 2025

Filed

Dec 22, 2025

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for AmpUp →

AmpUp, Inc. experienced unauthorized access to its Stripe online payment platform on October 25, 2025. An unauthorized user leveraged the company's Stripe API Key to initiate fraudulent financial transactions associated with customer accounts. AmpUp detected the incident on the same day, reversed the transactions, rotated passwords, and implemented additional access controls. Affected data includes full names and financial account information. No specific count of affected individuals was disclosed.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 58 days

Oct 25, 2025

Begins

Oct 25, 2025

Discovered

Dec 22, 2025

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_1ce574c0effd870c2025-12-22Verified
Maine State AGbd_ee2946366e9c992a2025-12-22Candidate
Massachusetts State AGbd_58cdd81ffa637dbf2025-12-23 · +1dVerified
New Hampshire State AGbd_b705ab0a7d335a2f2025-12-29 · +7dVerified

Name: AmpUp
norm: ampup
Domain: ampup.ai

Name: AmpUp
norm: ampup
Domain: ampup.ai
Industry: TechnologyllmFinancial Servicesllm

Discovered: Oct 25, 2025
Breach occurred: Oct 25, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Third party: via Stripe
Initial access: valid_credentials

During the incident: Commenced a prompt and thorough investigation
Worked closely with external cybersecurity professionals
Immediately reversed the transactions
Rotated all passwords
Implemented additional access controls
Changes made: Implemented additional access controls to ensure this incident would not occur again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGDec 22 · first

Maine State AGDec 22 · first

Vermont State AGDec 22 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+7d

Pattern: first filing Dec 22 (IN), last Dec 29 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-12-22-ampup-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2025
Raw hash: c595889dcde004cbbad6e25f408ded1dca581102936d3f6b1409b9fee2cece05

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAmpUp

Victim entityAmpUp

Incidentdiscovered Oct 25, 2025

Stated responseCommenced a prompt and thorough investigation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov