HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained

Inotiv, Inc.

bd_ee3cf19cee079632 · schema v1 · pii pii-v1

Full breach record for Inotiv, Inc. →

Inotiv, Inc. submitted a supplemental notice to the New Hampshire Attorney General regarding a cybersecurity incident occurring between August 5-8, 2025. The company discovered on November 21, 2025 that a threat actor may have acquired personal information, including names, SSNs, tax IDs, DOBs, and health insurance info. A total of 14 New Hampshire residents were potentially affected. Inotiv notified 11 residents on December 2, 2025, and subsequently identified 3 additional affected residents and 1 resident with additional data types, notifying them on December 23, 2025. The company offered 24 months of credit monitoring via Experian.

Leak gap clock⏱ Leak >90d5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

This filing is one of 2 about the same incident.View merged incident

A leak claim by qilin about this victim predates this filing by 137 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

bd_8e132b89047d54eeTexas State AGfiled 2025-12-29(6d gap)Candidate

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/inotiv-20251223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2025
Raw hash: ec12a522632052254efb51fb45289c539137ba09640bee64cbeef9f8882fceeb

Reporting entity

Name: Inotiv, Inc.
norm: inotiv
Domain: inotiv.com

Victim entity

Name: Inotiv, Inc.
norm: inotiv
Domain: inotiv.com

Incident

Discovered: Nov 21, 2025
Materiality determined: —
Notification sent: Dec 23, 2025
Affected individuals: 14
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Submitted update to Legal Notice of Information Security Incident to New Hampshire Office of the Attorney General
Initial access: valid_credentials

Compliance

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Extraction provenance

Status: No extraction artifact recorded for this disclosure.