HackingCapture Stored DataData ExfiltratedCustomer Data InvolvedTargetedDelayed DiscoveryPIICREDENTIALSFINANCIALLowContained
NEVRO CORP.
bd_b94fba3fd31eb0e4 · schema v1 · pii pii-v1
Full breach record for NEVRO CORP. →Nevro Corp. identified suspicious network activity on December 1, 2024. Investigation determined an unknown external individual gained unauthorized access to a small number of systems and may have exfiltrated data between November 21 and December 1, 2024. Affected data includes name, Social Security number, and financial account information. Four Maine residents were affected out of 17,478 total. Notification was sent April 2, 2025, with credit monitoring offered via Cyberscout.
Maine clockDiscovered Dec 1, 2024 → Filed with AG Apr 2, 2025122d ✗ ME AG >90d17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_2f15681c90c24378California State AGfiled 2025-04-02Candidate
- bd_9385df3948cc112dNew Hampshire State AGfiled 2025-04-02Verified
- bd_9bdd3acd8143be1fIndiana State AGfiled 2025-04-02Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/eff027c5-8381-4bd8-8663-ff5f2d43488f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 2, 2025
- Raw hash
- c606252e6e69eb9fff11973a56541354ccd4198377515a2ad26626c00d853e04
Reporting entity
- Name
- NEVRO CORP.norm: nevro
- Domain
- nevro.com
Victim entity
- Name
- NEVRO CORP.norm: nevro
- Domain
- nevro.com
Incident
- Discovered
- Dec 1, 2024
- Materiality determined
- —
- Notification sent
- Apr 2, 2025
- Affected individuals
- 4
- Data types
- PIICREDENTIALSFINANCIAL
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified Maine Attorney GeneralNotified federal law enforcementNotified three major credit reporting agencies (Equifax, Experian, TransUnion)
Compliance
- Time to disclose
- 17 weeks(122 days from discovery to filing)
- Compliance flags
- ME AG >90d · 122dME resident >60d · 122d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Dec 1, 2024→ Filed with AG: Apr 2, 2025122d 90 days ME AG >90d Maine Discovered: Dec 1, 2024→ Notified: Apr 2, 2025122d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.