UnknownMedium

illumifin

bd_c525393ebdb28714 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 4, 2025

Filed

Apr 22, 2026

To disclose

24 weeks

Affected

97,781

Linked

12 filings

Confidence

95%

Full breach record for illumifin →

illumifin Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2026-04-22. The breach occurred during 10/28/2025 - 11/4/2025. The breach was discovered on 11/4/2025. 97,781 individuals were affected. Notice was sent on 4/22/2026.

J jump to incidentP pin to compareR raw source

Oregon clock✗ OR AG >45d24 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 7 days

discovery → filing · 24 weeks / 169 days

Oct 28, 2025

Begins

Nov 4, 2025

Discovered

Apr 22, 2026

Filed

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

New Hampshire State AGbd_45251292f85141d12026-04-22Verified
South Carolina State AGbd_e3b9b22227324eae2026-04-07 · +15dVerified
Texas State AGbd_89959561b8e6cb302026-04-02 · +20dVerified
Massachusetts State AGbd_13235aa3216392ba2026-03-31 · +22dVerified

Show 6 more filings ↓up to 43d gap

Montana State AGbd_4834a8e85a0c3a7b2026-03-31 · +22dVerified
California State AGbd_4f85d73db2552a712026-03-31 · +22dVerified
Indiana State AGbd_61ed61057416aef12026-03-31 · +22dVerified
New Hampshire State AGbd_6bd728330d6299662026-03-31 · +22dVerified
Nebraska State AGbd_4fe7e34d290fb03a2026-03-13 · +40dVerified
HHS OCRbd_302d552bb1288e6f2026-03-10 · +43dVerified

Showing first 10 of 11 linked disclosures.

Name: illumifin
Domain: illumifin.com

Name: illumifin
Domain: illumifin.com

Discovered: Nov 4, 2025
Breach occurred: Oct 28, 2025 – Nov 4, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 22, 2026
Affected individuals: 97,781nationwide
Data types: —
Attack vector: Unknown

Time to disclose: 24 weeks(169 days from discovery to filing)
Compliance flags: OR AG >45d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

HHS OCRMar 10 · first

Nebraska State AG+3d

Massachusetts State AG+21d

Montana State AG+21d

California State AG+21d

Indiana State AG+21d

New Hampshire State AG+21d

Texas State AG+23d

South Carolina State AG+28d

New Hampshire State AG+43d

Oregon State AG+43d · this page

Pattern: first filing Mar 10 (MN), last Apr 22 (OR) — a 43-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://justice.oregon.gov/consumer/DataBreach/
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2026
Raw hash: 0bbb2ba85cac3e4f0ce78b2c81ab4918d78510630ff6daf0d0d00aa3c3390e82

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityillumifin

Victim entityillumifin

Incidentdiscovered Nov 4, 2025

ComplianceOR AG >45d

Extraction provenanceno artifact recorded

Source provenancejustice.oregon.gov