H2O.AI, INC.
bd_e73774e23c960a08 · schema v1 · pii pii-v1
Full breach record for H2O.AI, INC. →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Linkc on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
As a result of our operation, we have discovered the following concerning data: 1. Unanonymized customer datasets intended for AI training. 2. Full source code of programs from the Git repository, including code for driverless systems, GPT models, and others. 3. A substantial amount of internal information, including contracts, customer personal data, project costs, and project documentation. 4. Backup copies of employee email accounts containing customer correspondence.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jan 29, 2025
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- Maine State AGbd_0ce52b580d7b1a572025-03-27 · +56dVerified
- Indiana State AGbd_3becfe55f66e60f92025-03-27 · +56dVerified
- Massachusetts State AGbd_415b1d6f291888ea2025-03-27 · +56dVerified by operator
- Maryland State AGbd_b08fbb3b839e8bb62026-04-23 · +448dVerified by operator
Filing propagation · 4 filings · 4 states
View merged incident ↗Pattern: first filing Mar 27 (ME), last Apr 23 (MD) — a 392-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
linkc
According to ransomware.live, Linkc is a ransomware group first observed in February 2025, operating a Tor-based data leak site and targeting US-based AI, cloud, aerospace, and manufacturing companies — including H2O.ai — demanding ransoms as high as $15 million using double-extortion tactics.