HackingEnergy & UtilitiesUtilitiesCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

FIVE STATES ENERGY COMPANY, L.L.C.

bd_ceaac5224b961c9e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2026

Filed

Mar 26, 2026

To disclose

—

Affected

Not disclosed

Linked

9 filings

Confidence

66%

Full breach record for FIVE STATES ENERGY COMPANY, L.L.C. →

Five States Energy Company, L.L.C. notified Nebraska AG of a network compromise detected on February 12, 2026. The incident potentially exposed names, Social Security numbers, and bank account numbers of individuals in investment files. The company engaged third-party experts, secured the network, and notified law enforcement. Affected individuals are offered 24 months of credit monitoring via Cyberscout. No evidence of fraud was found at the time of notification.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

Feb 12, 2026

Discovered

Mar 26, 2026

Filed

This filing is one of 9 about the same incident.View merged incident

A leak claim by dragonforce about this victim predates this filing by 42 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitedragonforcebd_10e7db3f7644f4062026-02-19 · +34dVerified by operator
Leak Sitedragonforcebd_e39e6d2fa52a6db32026-02-12 · +42dVerified by operator

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_cf6cb656efb1ddef2026-03-26Candidate
New Hampshire State AGbd_8611858ddbd143652026-04-02 · +7dVerified
Vermont State AGbd_f089861523f7f4752026-04-02 · +7dVerified
Maine State AGbd_fdec22ccffee3a4f2026-04-02 · +7dVerified

Show 2 more filings ↓up to 113d gap

Texas State AGbd_946f8dbde8d6f2b42026-04-06 · +11dVerified
Massachusetts State AGbd_e8d95536a0c570492026-07-17 · +113dVerified

Name: FIVE STATES ENERGY COMPANY, L.L.C.
norm: five states energy
Domain: fivestates.com

Name: FIVE STATES ENERGY COMPANY, L.L.C.
norm: five states energy
Domain: fivestates.com
Industry: Energy & Utilitiesllm

Discovered: Feb 12, 2026
Materiality determined: —
Notification sent: Mar 26, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: notified and communicated with law enforcement regarding this incident
Initial access: exploit_public_facing

During the incident: Detected and stopped a compromise of its network environment
Secured and remediated the compromise
Engaged additional third-party experts
Commenced an investigation
Notified and communicated with law enforcement regarding this incident
Changes made: Continuously enhancing our systems’ security
Focused on continuous awareness training and assessment of our data security
Providing you with access to free credit monitoring through Cyberscout, a TransUnion company
Providing you with proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGMar 26 · first

Nebraska State AGMar 26 · first · this page

New Hampshire State AG+7d

Vermont State AG+7d

Maine State AG+7d

Texas State AG+11d

Massachusetts State AG+113d

Pattern: first filing Mar 26 (IN), last Jul 17 (MA) — a 113-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/72a6bd5b-a5ee-4c7e-a282-08af02f72830.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2026
Raw hash: 34567f73aa4de73e406d6bd460260fc5ed366e0467083140e23e4c60c88f3864

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityFIVE STATES ENERGY COMPANY, L.L.C.

Victim entityFIVE STATES ENERGY COMPANY, L.L.C.

Incidentdiscovered Feb 12, 2026

Stated responseDetected and stopped a compromise of its network environment

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov