HackingPIIIdentity (basic)Government IDCredentialsMediumContained

Travala

bd_8a3d4a84fa95a2a6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2026

Filed

Jul 5, 2026

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

66%

Full breach record for Travala →

Travala Pte. Ltd. notified Nebraska residents in July 2026 of improper access to customer personal data. The incident involved names, contact info, passport details, and hashed credentials. The company contained the incident, secured systems, and engaged external specialists. No evidence of fund theft or unauthorized changes was found.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 1, 2026

Discovered

Jul 5, 2026

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_120e7222fb9ed6a12026-07-05Verified
New Hampshire State AGbd_5cf40a13a5acd5842026-06-29 · +6dCandidate
Massachusetts State AGbd_b9824bf99283e4282026-06-29 · +6dVerified
Vermont State AGbd_fd012d8c39a179c52026-06-29 · +6dVerified

Name: Travala
norm: travala
Domain: travala.com

Name: Travala
norm: travala
Domain: travala.com

Discovered: Jul 1, 2026
Materiality determined: —
Notification sent: Jul 1, 2026
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Government IDCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notified the relevant data protection authorities, including but not limited to the Personal Data Protection Commission in Singapore
Initial access: valid_credentials

During the incident: Incident was immediately contained
Secured the affected systems
Strengthened our monitoring
Working with external security specialists
Notified the relevant data protection authorities
Changes made: Strengthened our monitoring
Secured the affected systems
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGJun 29 · first

Massachusetts State AGJun 29 · first

Vermont State AGJun 29 · first

Indiana State AG+6d

Nebraska State AG+6d · this page

Pattern: first filing Jun 29 (NH), last Jul 5 (NE) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/8da908aa-2264-4d48-84b3-cb0d998c3a93.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 5, 2026
Raw hash: a0c2cf71c4bc7a52043fdf1cc0ae2bf52be3a7250274a54e96d5dcddb96fdff4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTravala

Victim entityTravala

Incidentdiscovered Jul 1, 2026

Stated responseIncident was immediately contained

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov