HackingTechnologyProfessional ServicesInformationCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
InStream, LLC
bd_b9e96871cb663a8a · schema v1 · pii pii-v1
Full breach record for InStream, LLC →InStream LLC, a data storage and digitization company based in Nashville, TN, discovered on April 23, 2025 that an unknown external actor had accessed systems in its Buffalo office between July 20–25, 2024 and copied files. The review concluded April 23, 2025. Data involved includes names and Social Security numbers. Six Maine residents were notified on June 4, 2025. Experian 12-month credit monitoring was offered to affected individuals.
Maine clockDiscovered Apr 23, 2025 → Filed with AG Jun 4, 202542d ⏱ ME AG >30d6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_3b7e6e47d117ec02New Hampshire State AGfiled 2025-06-04Verified
- bd_ad3d1915dde1c4fcVermont State AGfiled 2025-06-04Candidate
- bd_b8bbef54fff5d39bIndiana State AGfiled 2025-06-04Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f166b568-5187-42f3-96cf-efd913c7efc5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 4, 2025
- Raw hash
- f60be4c372751009397382bbdefb71437fc35a787f7bdc6e63bcd6576ec01c6b
Reporting entity
- Name
- InStream, LLCnorm: instream
- Domain
- instreamllc.com
- Industry
- Data storage and digitization
Victim entity
- Name
- InStream, LLCnorm: instream
- Domain
- instreamllc.com
- Industry
- Data storage and digitization
- Industry
- TechnologyllmProfessional Servicesllm
Incident
- Discovered
- Apr 23, 2025
- Materiality determined
- —
- Notification sent
- Jun 4, 2025
- Affected individuals
- 6
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified state and federal regulatorsNotified three major credit reporting agencies (Equifax, Experian, TransUnion)Posted notice on company websiteNotified media in relevant jurisdictionsNotified law enforcement
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- ME AG >30d · 42d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Apr 23, 2025→ Filed with AG: Jun 4, 202542d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.