HackingFinancial ServicesTechnologyFinanceVulnerability ExploitStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Decisionfi LLC

bd_b39406ddea3c7aa7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2025

Filed

Feb 21, 2025

To disclose

5 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Decisionfi LLC →

Decisionfi LLC notified New Hampshire residents of a data breach occurring on or around January 15, 2025. An unknown actor accessed files via the web application. Personal information, including government IDs, was involved. Decisionfi engaged third-party cybersecurity specialists, secured the application, and notified federal law enforcement. Affected individuals are offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Jan 15, 2025

Discovered

Jan 28, 2025

Scope determined

Feb 21, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maryland State AGbd_36f843a5fae646c82025-02-21Verified
Nebraska State AGbd_5e014b968395b2d12025-02-21Verified
Massachusetts State AGbd_7e35b65b4a4d38d12025-02-21Verified
Indiana State AGbd_9e373c38bbbc7ce52025-02-21Candidate

Name: Decisionfi LLC
norm: decisionfi

Name: Decisionfi LLC
norm: decisionfi
Industry: Financial ServicesllmTechnologyllm

Discovered: Jan 15, 2025
Materiality determined: Jan 28, 2025
Notification sent: Feb 21, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement regarding the event
Initial access: exploit_public_facing

During the incident: Initiated an investigation with the assistance of third-party cybersecurity specialists
Assessed the security of our environment
Notified potentially affected individuals
Secured our application
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Changes made: Reviewing and enhancing our existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maryland State AGFeb 21 · first

Nebraska State AGFeb 21 · first

Massachusetts State AGFeb 21 · first

Indiana State AGFeb 21 · first

New Hampshire State AGFeb 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/decisionfi-20250221.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2025
Raw hash: dba7bde258a36a82410e406facab30afdd3126360eb3e5f7a3829c80405f5a96

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDecisionfi LLC

Victim entityDecisionfi LLC

Incidentdiscovered Jan 15, 2025

Stated responseInitiated an investigation with the assistance of third-party cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov