HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIFinancial accountLowContained

Pure Haven, LLC

bd_829aa23f6a3cf349 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 3, 2025

Filed

Oct 20, 2025

To disclose

7 weeks

Affected

11state residents only

Linked

7 filings

Confidence

66%

Full breach record for Pure Haven, LLC →2 incidents on file

Pure Haven, LLC notified the New Hampshire Attorney General of a data breach affecting 11 residents. Unauthorized access to a third-party application occurred on September 2, 2025, discovered on September 3, 2025. Impacted data included names and payment card information. Pure Haven engaged forensic specialists, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 7 weeks / 47 days

Sep 2, 2025

Begins

Sep 3, 2025

Discovered

Oct 20, 2025

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_3d154cd0b4ca47b02025-10-20Verified
Montana State AGbd_382952dfbf1788f12025-10-13 · +7dCandidate
Maine State AGbd_53f22717546d6dc82025-10-13 · +7dVerified
Nebraska State AGbd_249e73ff0e66569b2025-10-10 · +10dVerified

Show 2 more filings ↓up to 10d gap

Vermont State AGbd_919cc03207e589fb2025-10-10 · +10dVerified
Indiana State AGbd_d8028d274933ede82025-10-10 · +10dVerified

Name: Cipriani
norm: cipriani
Domain: cipriani.com
Industry: legal_services

Name: Pure Haven, LLC
norm: pure haven

Discovered: Sep 3, 2025
Breach occurred: Sep 2, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 10, 2025
Affected individuals: 11state-resident count only
Data types: PIIFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General
Initial access: valid_credentials

During the incident: Disabled the relevant employee access to the application
Engaging third-party forensic specialists to assist in a thorough investigation
Secured the relevant account
Conducted an investigation
Began providing notice to the potentially impacted individuals on October 10, 2025, via U.S. mail
Offering the potentially impacted individuals complimentary credit monitoring and identity protection services
Changes made: Offering complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Nebraska State AGOct 10 · first

Vermont State AGOct 10 · first

Indiana State AGOct 10 · first

Montana State AG+3d

Maine State AG+3d

Massachusetts State AG+10d

New Hampshire State AG+10d · this page

Pattern: first filing Oct 10 (NE), last Oct 20 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pure-haven-20251020.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2025
Raw hash: 82d9653bedd4b56fd3a455edfcf4f7326cfdab9a485a7fc028308c3e872488c2

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityCipriani

Victim entityPure Haven, LLC

Incidentdiscovered Sep 3, 2025

Stated responseDisabled the relevant employee access to the application

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov