HackingTechnologyInformationData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

InStream, LLC

bd_d3daec81d0ed117e · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jul 20, 2024

Filed

Jun 4, 2025

To disclose

—

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for InStream, LLC →2 incidents on file

InStream LLC, a data storage and digitization company, reported an unauthorized access incident affecting systems in its Buffalo office between July 20 and July 25, 2024. An unknown actor copied files containing personal information, including names, Social Security numbers, and government-issued IDs. InStream notified law enforcement, secured systems, and began notifying affected individuals starting October 16, 2024, with specific notices to Nebraska residents sent on June 4, 2025. Credit monitoring services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

Jul 20, 2024

Begins

Jul 20, 2024

Discovered

Jun 4, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_3b7e6e47d117ec022025-06-04Verified
Vermont State AGbd_ad3d1915dde1c4fc2025-06-04Candidate
Indiana State AGbd_b8bbef54fff5d39b2025-06-04Verified
Maine State AGbd_b9e96871cb663a8a2025-06-04Verified

Name: InStream, LLC
norm: instream
Domain: instreamllc.com

Name: InStream, LLC
norm: instream
Domain: instreamllc.com
Industry: Technologyllm

Discovered: Jul 20, 2024
Breach occurred: Jul 20, 2024 – Jul 25, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 16, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Regulator citations: providing written notice of the Event to relevant state and federal regulators, and to the three major credit reporting agencies
Initial access: exploit_public_facing

During the incident: Access and secure the network
Taking certain systems offline
Reviewing the involved systems and files
Notifying law enforcement
Notifying potentially involved clients and individuals as information became available
Reviewing and enhancing its existing policies, procedures, and security tools
Offering potentially impacted individuals access to credit monitoring services for twelve (12) months, through Experian, at no cost to the individuals
Providing written notice of the Event to relevant state and federal regulators, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Posted notice of the event on its website
Notifying the media in relevant jurisdictions
Changes made: Reviewing and enhancing its existing policies, procedures, and security tools to reduce the likelihood of a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGJun 4 · first

Vermont State AGJun 4 · first

Indiana State AGJun 4 · first

Maine State AGJun 4 · first

Nebraska State AGJun 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/e6d8706b-bd00-42b8-9262-a6f180c096c6.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 4, 2025
Raw hash: b0e9a9d484e99fd15a053fda80e666c248554ba86a755844ddcb3b9c12a389da

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityInStream, LLC

Victim entityInStream, LLC

Incidentdiscovered Jul 20, 2024

Stated responseAccess and secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov