HackingIDENTITY_BASICFINANCIAL_ACCOUNTLowContained

AmpUp

bd_b705ab0a7d335a2f · schema v1 · pii pii-v1

AmpUp, Inc. notified the New Hampshire Attorney General of a cybersecurity incident occurring on October 25, 2025. An unauthorized user accessed AmpUp's Stripe payment platform using a valid API key, initiating fraudulent financial transactions. The incident affected approximately two New Hampshire residents, exposing full names and payment card or financial account information. AmpUp reversed transactions, rotated passwords, and engaged cybersecurity experts. Notifications to affected individuals began on December 22, 2025.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

bd_1ce574c0effd870cIndiana State AGfiled 2025-12-22(7d gap)Verified
bd_7296064165221cdeVermont State AGfiled 2025-12-22(7d gap)Verified
bd_ee2946366e9c992aMaine State AGfiled 2025-12-22(7d gap)Candidate

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ampup-20251229.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2025
Raw hash: eede91e631e9e43fdcb659d2e139e72636227c41a6db124fe8de794306d3aee7

Reporting entity

Name: AmpUp
norm: ampup
Domain: ampup.ai

Victim entity

Name: AmpUp
norm: ampup
Domain: ampup.ai

Incident

Discovered: Oct 25, 2025
Materiality determined: —
Notification sent: Dec 22, 2025
Affected individuals: 2
Data types: IDENTITY_BASICFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: valid_credentials

Compliance

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.