HackingProfessional ServicesProfessional ServicesVulnerability ExploitTargetedData ExfiltratedIdentity (basic)Government IDHighContained

Inotiv, Inc.

bd_d8edef04448918b2 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 17, 2025

Filed

Dec 23, 2025

To disclose

6 days

Affected · nationwide

10,4827 in this filing

Linked

15 records

Confidence

65%

Full breach record for Inotiv, Inc. →

Inotiv, Inc. reported an external system breach (hacking) occurring on August 5, 2025, discovered on December 17, 2025. The incident affected 10,482 individuals, including 7 Maine residents. Data types compromised included names, personal identifiers, SSNs, and driver's license numbers. Inotiv engaged external cybersecurity specialists, notified law enforcement, and provided 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d6 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 134 days

discovery → filing · 6 days

Aug 5, 2025

Begins

Dec 17, 2025

Discovered

Dec 23, 2025

Filed

vs. sector median

19 wks faster

This filing is one of 15 records about the same incident.View merged incident

A leak claim by qilin about this victim was first seen 126 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Nebraska State AGbd_9fdb1f68fc6a3e022025-12-23Verified by operator
New Hampshire State AGbd_ee3cf19cee0796322025-12-23Verified
California State AGbd_eff7143c236edf7c2025-12-23Verified
Vermont State AGbd_c1146c807292b96b2025-12-22 · +1dVerified

Show 6 more filings ↓up to 21d gap

Texas State AGbd_8e132b89047d54ee2025-12-29 · +6dCandidate
Massachusetts State AGbd_a3d617a135433fef2025-12-03 · +20dVerified
Nebraska State AGbd_1787a30044a975922025-12-02 · +21dVerified by operator
New Hampshire State AGbd_44e1e024dc1bcc1c2025-12-02 · +21dVerified
California State AGbd_62110b9d0e035dd62025-12-02 · +21dVerified
Maine State AGbd_6cafa0e37330d9092025-12-02 · +21dVerified

Showing first 10 of 14 linked disclosures.

Name: Inotiv, Inc.
norm: inotiv
Domain: inotiv.com

Name: Inotiv, Inc.
norm: inotiv
Domain: inotiv.com
Industry: Professional Servicesnaics map

Discovered: Dec 17, 2025
Breach occurred: Aug 5, 2025
Undetected for: 134 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 23, 2025
Affected individuals: 10,482state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation with the support of external cybersecurity specialists
Notified law enforcement
Offering complimentary credit monitoring and identity theft protection services through Experian IdentityWorks for 24 months
Changes made: Taken steps to address the incident and to further enhance our security measures to protect your data
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: Leak >90dME AG ≤30d · 6d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 17, 2025
→ Filed with AG: Dec 23, 2025
6d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 17, 2025 → Filed with AG: Dec 23, 2025	6d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Nebraska State AGDec 2 · first

New Hampshire State AGDec 2 · first

California State AGDec 2 · first

Maine State AGDec 2 · first

Massachusetts State AG+1d

Vermont State AG+20d

Nebraska State AG+21d

New Hampshire State AG+21d

California State AG+21d

Maine State AG+21d · this page

Texas State AG+27d

Pattern: first filing Dec 2 (NE), last Dec 29 (TX) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 14 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a24619fc-d5da-480a-bcea-f62c6f9fa7cb.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2025
Raw hash: f0e5a5d973313621978257f7de2f97e006d3f80e245e0367c1222c7a3f546312

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityInotiv, Inc.

Victim entityInotiv, Inc.

Incidentdiscovered Dec 17, 2025

Stated responseLaunched an investigation with the support of external cybersecurity specialists

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov