HackingRetail & ConsumerRetailVulnerability ExploitData ExfiltratedCustomer Data InvolvedFinancial accountLowContained

PalmFlex, Inc

bd_e20269296b89922f · schema v1 · pii pii-v2

Severity

Low

Discovered

Jun 25, 2026

Filed

Jul 22, 2025

To disclose

—

Affected

Not disclosed

Confidence

64%

Full breach record for PalmFlex, Inc →2 incidents on file

PalmFlex Inc. notified Nebraska customers of a data breach occurring between April 2, 2026, and June 25, 2026. A third party accessed the administrative interface and injected unauthorized code, potentially compromising payment card information for orders placed during that window. PalmFlex engaged cybersecurity specialists, reset credentials, and implemented additional security controls. Notices were sent on July 15, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Jul 22, 2025

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: PalmFlex, Inc
norm: palmflex

Name: PalmFlex, Inc
norm: palmflex
Industry: Retail & Consumerllm

Discovered: Jun 25, 2026
Breach occurred: Apr 2, 2026 – Jun 25, 2026
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2026
Affected individuals: Not disclosed
Data types: Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged hosting provider and cybersecurity specialists to investigate the incident
Secured systems
Reset administrative credentials
Implemented additional access restrictions
Strengthened monitoring and security controls
Changes made: Implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/ad210037-8271-43b0-aa3f-21e00b829441.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2025
Raw hash: b2b440cd17a29683ee50f779dd9ac1eda58151cd088c0ba0c7b1a97aa36f26c2

Reporting entityPalmFlex, Inc

Victim entityPalmFlex, Inc

Incidentdiscovered Jun 25, 2026

Stated responseEngaged hosting provider and cybersecurity specialists to investigate the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov