HackingTechnologyRetail & ConsumerInformationStolen CredentialsEmail MisuseData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Edmunds.com, Inc.

bd_f8fa20e85c912304 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 19, 2025

Filed

Nov 14, 2025

To disclose

12 weeks

Affected · nationwide

171 in this filing

Linked

3 filings

Confidence

67%

Full breach record for Edmunds.com, Inc. →

Edmunds.com, Inc. notified Montana residents of a data breach involving a third-party vendor's messaging tool. Unauthorized activity was detected on August 19, 2025, potentially impacting 17 messages containing names, SSNs, credit card info, and driver's license data. Edmunds offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 87 days

Aug 19, 2025

Begins

Aug 19, 2025

Discovered

Nov 14, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteshinyhuntersbd_a284303f227591832025-09-30 · +45dVerified

Regulatory filings (1) · sorted by filing gap

Nebraska State AGbd_412502c6b35dee2a2025-11-14Verified

Name: Edmunds.com, Inc.
norm: edmundscom
Domain: edmunds.com

Name: Edmunds.com, Inc.
norm: edmundscom
Domain: edmunds.com
Industry: TechnologyllmRetail & Consumerllm

Discovered: Aug 19, 2025
Breach occurred: Aug 19, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 17state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched a comprehensive investigation to assess the potential scope of the incident
Arranged 24 months of credit monitoring services from IDX
Enhanced safeguards designed to prevent unauthorized access
Changes made: Enhanced safeguards designed to prevent unauthorized access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(87 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGNov 14 · first

Montana State AGNov 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/11/Consumer-notification-letter-41.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 14, 2025
Raw hash: 43eb4b7a3f9c589b6dd2e1b371b3fec15cd78c8260aa6a93b3b993879473b78f

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityEdmunds.com, Inc.

Victim entityEdmunds.com, Inc.

Incidentdiscovered Aug 19, 2025

Stated responseLaunched a comprehensive investigation to assess the potential scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov