HackingIdentity (basic)LowContained

IXM

bd_de923f3661a979cb · schema v1 · pii pii-v2

Severity

Low

Discovered

Jun 5, 2025

Filed

Oct 3, 2025

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for IXM →

IXM Holdings, Inc. notified Nebraska residents of a cybersecurity event where unauthorized access occurred on its network between May 27 and June 5, 2025. The company discovered the activity on June 5, 2025, and engaged forensic specialists. The incident may have involved names. IXM provided 12 months of complimentary credit monitoring via Cyberscout (TransUnion). No evidence of misuse was found. The notification letter is dated October 3, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 9 days

May 27, 2025

Begins

Jun 5, 2025

Discovered

Oct 3, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_4a2ce185f7ae78752025-10-03Candidate
Massachusetts State AGbd_dd99244b0fee74c92025-10-03Verified

Name: IXM
norm: ixm
Domain: ixmetals.com

Name: IXM
norm: ixm
Domain: ixmetals.com

Discovered: Jun 5, 2025
Breach occurred: May 27, 2025 – Jun 5, 2025
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic specialists to investigate this matter
Reviewed our policies and procedures related to data protection
Arranged for you to activate, at no cost to you, an online credit monitoring service for 12 Months provided by Cyberscout, a TransUnion company
Changes made: Reviewed our policies and procedures related to data protection
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGOct 3 · first

Massachusetts State AGOct 3 · first

Nebraska State AGOct 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/de791e04-0bc8-4758-b0c3-a0f82c84d0a5.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2025
Raw hash: a3675779f3cd537ed05fd9f3eea7ac4e3c34f6a4000292ba0782af1deb19da97

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityIXM

Victim entityIXM

Incidentdiscovered Jun 5, 2025

Stated responseEngaged third-party forensic specialists to investigate this matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov