AccidentalTechnologyInformationMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Hurix Digital Inc

bd_e1bccc8c9fb9a942 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 23, 2026

Filed

Jan 23, 2026

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Hurix Digital Inc →

Hurix Digital Inc. notified Nebraska AG of a data security incident on January 23, 2026, involving the misdelivery of IRS Form 1099 documents containing names and Social Security numbers to unintended recipients via an internal email distribution error. Hurix recalled emails where possible, notified recipients, and provided 24 months of free credit monitoring through Epiq.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 23, 2026

Begins

Jan 23, 2026

Discovered

Jan 23, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_253544bee5fa56ad2026-02-23 · +31dCandidate
Massachusetts State AGbd_943bb86d622c0bb52026-02-23 · +31dVerified

Name: Hurix Digital Inc
norm: hurix digital

Name: Hurix Digital Inc
norm: hurix digital
Industry: Technologyllm

Discovered: Jan 23, 2026
Breach occurred: Jan 23, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 23, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1534 Internal Proxy

During the incident: Attempting to recall the email where technically possible
Contacting the unintended recipients with instructions to delete the email and any attachments
Recalled all unopened emails
Sent emails informing recipients of the mis-delivery and requested that they immediately delete the email they had received from their inbox and trash
Steps are taken in place to prevent a reoccurrence, including additional diligence and training of employees with respect to mail merge
Changes made: Additional diligence and training of employees with respect to mail merge
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Nebraska State AGJan 23 · first · this page

Indiana State AG+31d

Massachusetts State AG+31d

Pattern: first filing Jan 23 (NE), last Feb 23 (MA) — a 31-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/97a50488-eb02-4884-87c3-8be2bd8dcbee.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2026
Raw hash: 0d4747be4f168a9b11c4cc97094e2f5687abc7c4c42338b9214b83f22775178b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHurix Digital Inc

Victim entityHurix Digital Inc

Incidentdiscovered Jan 23, 2026

Stated responseAttempting to recall the email where technically possible

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov