HackingTechnologyInformationMisconfigurationCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)LowContained

EXOSTAR LLC

bd_f4f9a86b3912b16e · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 1, 2023

Filed

Dec 23, 2024

To disclose

15 months

Affected

1state residents only

Linked

2 filings

Confidence

64%

Full breach record for EXOSTAR LLC →

Exostar LLC notified the NH AG of a data event involving unauthorized access to a third-party system. Unauthorized actors exploited a configuration issue to access and copy files between Oct 2023 and Apr 2024. One NH resident was affected. Exostar provided credit monitoring and identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 16, 2023

Begins

Nov 22, 2024

Scope determined

Dec 23, 2024

Filed

vs. sector median

+45 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_a811c456ab6535562024-12-23Candidate

Name: EXOSTAR LLC
norm: exostar

Name: EXOSTAR LLC
norm: exostar
Industry: Technologyllm

Discovered: Oct 1, 2023
Breach occurred: Oct 16, 2023 – Apr 11, 2024
Materiality determined: Nov 22, 2024
Notification sent: Dec 23, 2024
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External

During the incident: Moved to investigate and respond appropriately
Assessing and confirming the security of Exostar systems
Working to identify potentially affected individuals
Worked with its vendors to implement enhanced security measures and additional monitoring tools
Providing access to credit monitoring services to individuals
Remediate the configuration issue
Conducted a thorough review of the contents of the affected files
Changes made: Implemented enhanced security measures and additional monitoring tools
Remediate the configuration issue
Review its existing policies and training protocols relating to data protection on an ongoing basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(449 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGDec 23 · first

New Hampshire State AGDec 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/exostar-20241223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 23, 2024
Raw hash: 553f87334eb6a2d3a92d2bab30794e4a5b63ff11b4260d906e0f4567e694a4da

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEXOSTAR LLC

Victim entityEXOSTAR LLC

Incidentdiscovered Oct 1, 2023

Stated responseMoved to investigate and respond appropriately

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov