PalmFlex, Inc
bd_e20269296b89922f · schema v1 · pii pii-v2
Full breach record for PalmFlex, Inc →The Nebraska Attorney General's register lists this notice on 2025-07-22, before the breach it reports. Indiana's register lists the same notice on 2026-07-22, so we publish 2026-07-22 as the date it was filed.
PalmFlex Inc. notified Nebraska customers of a data breach occurring between April 2, 2026, and June 25, 2026. A third party accessed the administrative interface and injected unauthorized code, potentially compromising payment card information for orders placed during that window. PalmFlex engaged cybersecurity specialists, reset credentials, and implemented additional security controls. Notices were sent on July 15, 2026.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 2, 2026
Begins
Jun 25, 2026
Discovered
Jul 22, 2026
Filed
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- Indiana State AGbd_298f5a4f9c1a24a12026-07-22Verified
- New Hampshire State AGbd_db6d1142a19f0a542026-07-21 · +1dVerified
- Massachusetts State AGbd_9ec6bf66561cd35f2026-07-15 · +7dCandidate
Filing propagation · 4 filings · 4 states
View merged incident ↗Pattern: first filing Jul 15 (MA), last Jul 22 (NE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.