HackingTechnologyFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIIDENTITY_GOVERNMENTFINANCIALIDENTITY_BASICMediumContained
INTUIT INC.
bd_8bb7b95ca1025ec3 · schema v1 · pii pii-v1
Full breach record for INTUIT INC. →Intuit Inc. notified 2 Maine residents that an unauthorized party accessed their TurboTax accounts on January 11, 2024, using credentials believed to have been obtained from a non-Intuit source. The unauthorized access may have exposed tax return data including names, Social Security numbers, addresses, dates of birth, driver's license numbers, and financial information. Accounts were temporarily locked and 12-month Experian IdentityWorks memberships were offered.
Maine clockDiscovered Jul 10, 2024 → Filed with AG Aug 9, 202430d ✓ ME AG ≤30d4 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_2ae85f5b7882bdcfNew Hampshire State AGfiled 2024-08-09Verified
- bd_c31354bea39b297eIndiana State AGfiled 2024-08-09Candidate
- bd_156e92e95f0fe3d3Indiana State AGfiled 2024-06-14(56d gap)Candidate
- bd_ef2650254b29f01bMontana State AGfiled 2024-06-14(56d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/53163cb2-bb1b-4916-8eb1-1fe273a55455.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 9, 2024
- Raw hash
- 27e80677dbdd50c0ce42e8f4e0d1c8372ae89ec4ae664c0a5fde3ce3f8a56e3f
Reporting entity
- Name
- INTUIT INC.norm: intuit
- Domain
- intuit.com
Victim entity
- Name
- INTUIT INC.norm: intuit
- Domain
- intuit.com
- Industry
- TechnologyllmFinancial Servicesllm
Incident
- Discovered
- Jul 10, 2024
- Materiality determined
- —
- Notification sent
- Aug 9, 2024
- Affected individuals
- 2
- Data types
- PIIIDENTITY_GOVERNMENTFINANCIALIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1589 Gather Victim Identity Information
- Threat actor
- ExternalFinancial
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 10, 2024→ Filed with AG: Aug 9, 202430d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.