HackingFinancial ServicesFinanceCustomer Data InvolvedData ExfiltratedGovernment IDFinancial accountIdentity (basic)MediumContained

YouLend US LLC

bd_b9c0261602d0e6e2 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jun 9, 2026

Filed

Sep 2, 2026

To disclose

12 weeks

Affected

5state residents only

Linked

7 filings

Confidence

70%

Full breach record for YouLend US LLC →2 incidents on file

YouLend US LLC filed a supplemental notice with the NH Attorney General regarding a data security incident. Unauthorized access occurred between June 5-9, 2026, discovered on June 9, 2026. This supplement identifies an additional 5 New Hampshire residents affected, bringing the total known NH residents to at least 5 (plus 89 in RI mentioned in the letter template). Affected data includes SSNs, financial account info, and payment card info. The company engaged cybersecurity specialists, secured systems, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 12 weeks / 85 days

Jun 5, 2026

Begins

Jun 9, 2026

Discovered

Sep 2, 2026

Filed

vs. sector median

+4 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_043932063574e4552026-09-02Verified
Texas State AGbd_e6de9e49116b37022026-09-03 · +1dVerified
Texas State AGbd_b0943eba6233f07c2026-07-17 · +47dVerified
Oregon State AGbd_184b8f1dc0796ead2026-07-15 · +49dVerified

Show 2 more filings ↓up to 49d gap

New Hampshire State AGbd_5847307b41c8a4eb2026-07-15 · +49dVerified
California State AGbd_f980748824188a162026-07-15 · +49dCandidate

Name: YouLend US LLC
norm: youlend us

Name: YouLend US LLC
norm: youlend us
Industry: Financial Servicesllm

Discovered: Jun 9, 2026
Breach occurred: Jun 5, 2026 – Jun 9, 2026
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2026
Affected individuals: 5state-resident count only
Data types: Government IDFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to federal law enforcement and other authorities

During the incident: Launched an immediate investigation
Engaged outside cybersecurity specialists to assist
Took steps to secure our systems
Reported the incident to federal law enforcement and other authorities
Offered 12 months of complimentary credit monitoring and identity protection services through CyberScout
Set up a professional call center through CyberScout to assist notified individuals
Changes made: Reviewing its existing security policies and protections
Adopting additional security to safeguard against evolving threats moving forward
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(85 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 4 states

View merged incident ↗

Oregon State AGJul 15 · first

New Hampshire State AGJul 15 · first

California State AGJul 15 · first

Texas State AG+2d

California State AG+49d

New Hampshire State AG+49d · this page

Texas State AG+50d

Pattern: first filing Jul 15 (OR), last Sep 3 (TX) — a 50-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/youlend-us-20260902.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 2, 2026
Raw hash: 5cb22e120b7ad4afbec0e924a7733fe2100080c4221bb727d5ea7b47f2aac908

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityYouLend US LLC

Victim entityYouLend US LLC

Incidentdiscovered Jun 9, 2026

Stated responseLaunched an immediate investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov