HackingTechnologyFinancial ServicesInformationVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsLowContained

InvoiceCloud

bd_72c05a49298b8e95 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 16, 2025

Filed

Jul 16, 2025

To disclose

4 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for InvoiceCloud →

InvoiceCloud, a provider of digital payment solutions, identified unauthorized code on systems supporting customer payment websites on June 16, 2025. The incident likely resulted in the scraping of names, addresses, emails, payment card numbers, CVVs, and expiration dates. Social Security numbers and bank account information were not impacted. InvoiceCloud engaged forensic investigators, contained the issue, and is offering one year of credit monitoring and identity restoration services to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday4 weeks discovery → filing

Incident timeline

discovery → filing · 4 weeks / 30 days

Jun 16, 2025

Begins

Jun 16, 2025

Discovered

Jul 16, 2025

Filed

vs. sector median

14 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_0f427a53a9556e142025-07-16Verified
New Hampshire State AGbd_41688672135d043c2025-07-16Candidate
Maine State AGbd_83a6de7d7eecefa42025-07-16Verified
Nebraska State AGbd_bc6e60159c3eebc62025-07-16Verified

Name: InvoiceCloud
norm: invoicecloud
Domain: invoicecloudservice.com

Name: InvoiceCloud
norm: invoicecloud
Domain: invoicecloudservice.com
Industry: TechnologyllmFinancial Servicesllm

Discovered: Jun 16, 2025
Breach occurred: Jun 16, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 16, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Financial accountFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took steps to stop the unauthorized code
Engaged a forensic firm to investigate
Offering one year of complimentary credit monitoring and identity restoration services through TransUnion
Deployed additional safeguards onto our systems
Reinforcing our security practices
Actively reviewing our systems to enhance security monitoring and controls
Changes made: Deployed additional safeguards onto our systems
Reinforcing our security practices
Actively reviewing our systems to enhance security monitoring and controls
Regularly review our security and privacy policies and procedures and implement changes when needed
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJul 16 · first

New Hampshire State AGJul 16 · first

Maine State AGJul 16 · first

Nebraska State AGJul 16 · first

Vermont State AGJul 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-07-16-invoicecloud-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2025
Raw hash: 7bd2bb22a2bfa44629dd4f00b62fd6567ca1f977a5d6aa649f048d827f8898fd

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityInvoiceCloud

Victim entityInvoiceCloud

Incidentdiscovered Jun 16, 2025

Stated responseTook steps to stop the unauthorized code

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov