HackingTechnologyInformationStolen CredentialsCustomer Data InvolvedFinancial accountPCILowActive

PalmFlex, Inc

bd_9ec6bf66561cd35f · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Jul 15, 2026

To disclose

—

Affected

19state residents only

Linked

4 filings

Confidence

67%

Full breach record for PalmFlex, Inc →

PalmFlex, Inc. notified Massachusetts customers on July 15, 2026, that payment card information may have been accessed by an unauthorized third party. The company engaged hosting providers and cybersecurity specialists to investigate, secure systems, reset credentials, and implement additional access restrictions. No specific count of affected individuals was provided.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 15, 2026

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_db6d1142a19f0a542026-07-21 · +6dVerified
Indiana State AGbd_298f5a4f9c1a24a12026-07-22 · +7dVerified
Nebraska State AGbd_e20269296b89922f2026-07-22 · +7dVerified

Name: PalmFlex, Inc
norm: palmflex

Name: PalmFlex, Inc
norm: palmflex
Industry: Technologyllm

Discovered: —
Materiality determined: —
Notification sent: Jul 15, 2026
Affected individuals: 19state-resident count only
Data types: Financial accountPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Engaged our hosting provider and cybersecurity specialists to investigate the incident
Secure our systems
Reset administrative credentials
Implement additional access restrictions
Strengthen monitoring and security controls
Changes made: Reset administrative credentials
Implement additional access restrictions
Strengthen monitoring and security controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 15 · first · this page

New Hampshire State AG+6d

Indiana State AG+7d

Nebraska State AG+7d

Pattern: first filing Jul 15 (MA), last Jul 22 (NE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1143-palmflex-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 15, 2026
Raw hash: 5cded259a1fd09b3dbeab1373411819b41bd1ec523f850ca224b31a0ff054a45

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPalmFlex, Inc

Victim entityPalmFlex, Inc

IncidentUnauthorized Access

Stated responseEngaged our hosting provider and cybersecurity specialists to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov