HackingEnergy & UtilitiesUtilitiesStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)LowContained

Luxe Energy LLC

bd_88cd41eaa5327a2f · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 9, 2020

Filed

Apr 21, 2020

To disclose

6 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Luxe Energy LLC →

Luxe Energy LLC notified affected individuals of a security incident involving unauthorized access to an employee's email account between October 19, 2018, and January 6, 2020. The breach exposed personal information including names and addresses. Luxe Energy secured the account, engaged forensic assistance, and provided one year of complimentary identity monitoring via Kroll. Enhanced security measures, including MFA, were implemented.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 507 days

discovery → filing · 6 weeks / 43 days

Oct 19, 2018

Begins

Mar 9, 2020

Discovered

Apr 21, 2020

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_27c74aa55b532e9a2020-04-21Verified
Indiana State AGbd_2a7e085cc41e60fd2020-04-21Verified

Name: Luxe Energy LLC
norm: luxe energy

Name: Luxe Energy LLC
norm: luxe energy
Industry: Energy & Utilitiesllm

Discovered: Mar 9, 2020
Breach occurred: Oct 19, 2018 – Jan 6, 2020
Undetected for: 507 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the email account
Launched an investigation
Engaged a cybersecurity firm to assist
Conducted a thorough review of the contents of the email account
Arranged for Kroll to provide identity monitoring at no cost to you for one year
Changes made: Implemented enhanced security measures, including multifactor authentication
Providing additional data security training to employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 21 · first

Indiana State AGApr 21 · first

Montana State AGApr 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-159.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 21, 2020
Raw hash: 2be857ee62b2fe55f267d2a8b592b51b9425bbcdc3eedf877e501a97c29087e3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityLuxe Energy LLC

Victim entityLuxe Energy LLC

Incidentdiscovered Mar 9, 2020

Stated responseSecured the email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov