AccidentalTechnologyInformationMisconfigurationEmployee Data InvolvedIdentity (basic)EmploymentFinancial accountLowResolved

AXOSOFT, LLC

bd_ea456d21eba95189 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 1, 2026

Filed

Apr 24, 2026

To disclose

23 days

Affected

7state residents only

Linked

2 filings

Confidence

65%

Full breach record for AXOSOFT, LLC →

Axosoft LLC (dba GitKraken) notified Massachusetts employees that personal and compensation data was inadvertently routed into internal telemetry systems via a third-party Claude Office 365 Excel integration. The incident occurred between March 4 and April 3, 2026, and was discovered on April 1, 2026. Affected data included names, work emails, employee IDs, salary, and 401(k) information. The company masked access, blocked the integration, and deleted the data. No unauthorized external access was detected.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d23 days discovery → filing

Incident timeline

undetected · 28 days

discovery → filing · 23 days

Mar 4, 2026

Begins

Apr 1, 2026

Discovered

Apr 24, 2026

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Washington State AGbd_a20eb0bfb0f95bdb2026-04-24Verified

Name: AXOSOFT, LLC
norm: axosoft
Domain: gitkraken.com

Name: AXOSOFT, LLC
norm: axosoft
Domain: gitkraken.com
Industry: Technologyllm

Discovered: Apr 1, 2026
Breach occurred: Mar 4, 2026 – Apr 3, 2026
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 25, 2026
Affected individuals: 7state-resident count only
Data types: Identity (basic)EmploymentFinancial account
Attack vector: Misconfiguration
Third party: via Claude Office 365 Excel integration

During the incident: Masked access to the affected data within hours of discovery
Blocked the responsible integration from submitting further data on April 3, 2026
Deleted all affected records from our primary database and cloud storage on April 3, 2026
Conducted a detailed access log investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGApr 24 · first

Massachusetts State AGApr 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-646-axosoft-llc-dba-gitkrakencom/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2026
Raw hash: a39ce811fe3d03be219931dce6ead10b3129e7e4645ce2dd0bcfe2e102e394be

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAXOSOFT, LLC

Victim entityAXOSOFT, LLC

Incidentdiscovered Apr 1, 2026

Stated responseMasked access to the affected data within hours of discovery

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov