HackingFinancial ServicesTechnologyFinanceStolen CredentialsCapture Stored DataData ExfiltratedData PublishedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHighContained

Transak, Inc.

bd_81c6f6b6647441e3 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 23, 2024

Filed

Feb 28, 2025

To disclose

23 weeks

Affected · nationwide

23,113554 in this filing

Linked

9 filings

Confidence

67%

Full breach record for Transak, Inc. →

Transak USA LLC notified Maryland AG of a data breach impacting 23,113 customers, including 554 Maryland residents. On Sept 23, 2024, an unknown actor compromised a single employee's credentials to access a third-party data host. The actor acquired and later published names and driver's license numbers. Transak engaged CrowdStrike, notified FBI/DHS, and offered credit monitoring. Remediation included MFA, VPN enhancements, and vendor audits.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d23 weeks discovery → filing

Incident timeline

discovery → filing · 23 weeks / 158 days

Sep 23, 2024

Discovered

Feb 28, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_3419009e5cf78b812025-02-28Verified
Maine State AGbd_35bc83b8aa1b49e72025-02-28Verified
Massachusetts State AGbd_619075abbd17214f2025-02-28Verified
Vermont State AGbd_761ade3211135d852025-02-28Verified

Show 4 more filings ↓up to 27d gap

Nebraska State AGbd_99a52dda14286cba2025-02-28Verified
Indiana State AGbd_ade85d7f854c66812025-02-28Verified
California State AGbd_ffe97878a4cef6862025-02-28Candidate
Illinois State AGbd_7dd9285bbbc45fe02025-02-01 · +27dVerified

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Transak, Inc.
norm: transak
Industry: Financial ServicesllmTechnologyllm

Discovered: Sep 23, 2024
Materiality determined: —
Notification sent: Feb 28, 2025
Affected individuals: 23,113state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Maryland Attorney GeneralContacted Department of Homeland SecurityContacted the FBI
Initial access: valid_credentials

During the incident: Retained CrowdStrike to assist with the investigation
Contacted global law enforcement agencies, including the Department of Homeland Security and the FBI
Notifying the individuals whose PII was impacted
Offering complimentary credit monitoring services
Changes made: Enforcing hardware-based MFA for accessing third-party vendor platforms where sensitive data is stored
Implementing VPN security enhancements
Improving EDR monitoring, including with its KYC vendor
Implementing endpoint security upgrades
Updated its access privilege modules
Requiring more frequent security audits of its third-party vendors
Implementing employee training to mitigate the risk of another cybersecurity event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 weeks(158 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGFeb 1 · first

New Hampshire State AG+27d

Maine State AG+27d

Massachusetts State AG+27d

Vermont State AG+27d

Nebraska State AG+27d

Indiana State AG+27d

California State AG+27d

Maryland State AG+27d · this page

Pattern: first filing Feb 1 (IL), last Feb 28 (MD) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376431.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 28, 2025
Raw hash: 9bc5d20ac9c1e2a0b59af2b5a01a8ceb5e5f5fb4fe7ad3c3ac30d5d37a282832

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityTransak, Inc.

Incidentdiscovered Sep 23, 2024

Stated responseRetained CrowdStrike to assist with the investigation

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov