HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumActive

Fundamental Administrative Services, LLC

bd_9ccaf8d53f204666 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 9, 2025

Filed

Aug 15, 2025

To disclose

—

Affected

3state residents only

Linked

7 filings

Confidence

65%

Full breach record for Fundamental Administrative Services, LLC →2 incidents on file

Fundamental Administrative Services LLC (Nebraska) reported a cybersecurity incident discovered January 9, 2025, involving unauthorized exfiltration of files between October 27, 2024, and January 13, 2025. The incident involved the theft of names, SSNs, driver's licenses, financial account info, and medical/insurance data. Fundamental notified federal law enforcement, provided 12 months of credit monitoring via IDX, and implemented additional security safeguards. Only 3 Nebraska residents were notified as of August 15, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 74 days

Oct 27, 2024

Begins

Jan 9, 2025

Discovered

Aug 15, 2025

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_212b6cfbed4a3a002025-08-15Verified
Indiana State AGbd_445273654278dca02025-08-15Verified
Vermont State AGbd_77eb9da16590123a2025-08-15Verified
Texas State AGbd_2f89919848471f4f2025-08-19 · +4dCandidate

Show 2 more filings ↓up to 76d gap

Illinois State AGbd_7b2755440d942a9f2025-08-01 · +14dVerified
South Carolina State AGbd_b9452b16c9250e212025-10-30 · +76dVerified

Name: Fundamental Administrative Services, LLC
norm: fundamental administrative

Name: Fundamental Administrative Services, LLC
norm: fundamental administrative
Industry: Professional Servicesllm

Discovered: Jan 9, 2025
Breach occurred: Oct 27, 2024 – Jan 13, 2025
Undetected for: 74 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this incident to relevant state and federal regulators
Initial access: phishing_link

During the incident: Notified federal law enforcement of the incident
Provided notice of the incident to data owners for which it stores protected information on its network
Provided notice of the incident via its website on March 21, 2025
Providing access to monitoring services for twelve (12) months, through IDX, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state and federal regulators, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion, as necessary
Changes made: Working to implement additional safeguards and training for its employees
Implemented additional technical security measures designed to prevent similar future incidents
Reviewing and enhancing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Illinois State AGAug 1 · first

Massachusetts State AG+14d

Indiana State AG+14d

Vermont State AG+14d

Nebraska State AG+14d · this page

Texas State AG+18d

South Carolina State AG+90d

Pattern: first filing Aug 1 (IL), last Oct 30 (SC) — a 90-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/fab6277a-4d93-4a18-a468-d8e839e0ccd5.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2025
Raw hash: 65910c1e25a84ac7427e439e38f0b5b6dd0d2b12e0ab20d36151cc57eb9ca869

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityFundamental Administrative Services, LLC

Victim entityFundamental Administrative Services, LLC

Incidentdiscovered Jan 9, 2025

Stated responseNotified federal law enforcement of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov