HackingTechnologyInformationCustomer Data InvolvedIdentity (basic)CredentialsFinancial accountBehaviorLowActive

Epik Holdings, Inc.

bd_b858195add59e72c · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 13, 2021

Filed

Sep 22, 2021

To disclose

7 days

Affected

300state residents only

Linked

8 filings

Confidence

66%

Full breach record for Epik Holdings, Inc. →

Epik Holdings, Inc. disclosed that unauthorized third parties accessed a backup copy of domain-side service accounts on or before September 13, 2021. The breach affected approximately 300 New Hampshire residents, exposing names, addresses, emails, usernames, passwords, phone numbers, transaction history, and for some, credit card information. The investigation is ongoing. Epik has secured access, applied additional security measures, and is offering free credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 days

Sep 13, 2021

Begins

Sep 13, 2021

Discovered

Sep 22, 2021

Filed

vs. sector median

18 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_24a1025a0aa385972021-09-22Verified
Washington State AGbd_728638994942c8ae2021-09-22Verified
Maine State AGbd_8580b47767c5ab332021-09-22Candidate
Massachusetts State AGbd_97ca2df622b2a7a62021-09-22Verified

Show 3 more filings ↓up to 2d gap

California State AGbd_04c8616c0dafed292021-09-20 · +2dVerified
Montana State AGbd_4997bb915de5559c2021-09-20 · +2dVerified
Indiana State AGbd_aca7cf9423a5c2cf2021-09-20 · +2dVerified

Name: Epik Holdings, Inc.
norm: epik holdings
Domain: epik.com

Name: Epik Holdings, Inc.
norm: epik holdings
Domain: epik.com
Industry: Technologyllm

Discovered: Sep 13, 2021
Breach occurred: Sep 13, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 20, 2021
Affected individuals: 300state-resident count only
Data types: Identity (basic)CredentialsFinancial accountBehavior
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement and other relevant authorities

During the incident: Retained multiple cybersecurity partners to investigate the incident, secure our services, help affected users, and notify you, law enforcement, and other relevant authorities
Secured access to its domain-side services
Applied additional security measures to help protect services and users going forward
Offer free credit monitoring until September 15, 2023, for all affected users
Changes made: Applied additional security measures to help protect services and users going forward
Offer free credit monitoring until September 15, 2023, for all affected users
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGSep 20 · first

Montana State AGSep 20 · first

Indiana State AGSep 20 · first

Oregon State AG+2d

Washington State AG+2d

Maine State AG+2d

Massachusetts State AG+2d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/epik-holdings-20210922.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2021
Raw hash: 5a6f21f71d0bc02276f63969190b2e41963b7bac8d00f48567016ad1e52ab9c4

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityEpik Holdings, Inc.

Victim entityEpik Holdings, Inc.

Incidentdiscovered Sep 13, 2021

Stated responseRetained multiple cybersecurity partners to investigate the incident, secure our services, help affected users, and notify you, law enforcement, and other relevant authorities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov