HackingTargetedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPIIMediumContained
Shiftster LLC
bd_ff21d2f05f75d28d · schema v1 · pii pii-v1
Full breach record for Shiftster LLC →Shiftster LLC (dba ESHYFT) notified consumers of a March 2025 unauthorized access to an AWS S3 bucket. Data potentially exposed included names, DOBs, addresses, VINs, and certain health information. No SSN was impacted. The incident was discovered via a 'cyber security researcher' notification. No evidence of misuse was found.
Vermont clock✗ VT AG >45 bday32 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_5cc76677f65bb4baNew Hampshire State AGfiled 2025-10-22(2d gap)Verified
- bd_60fc09f62fe686caIndiana State AGfiled 2025-08-27(54d gap)Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-20-shiftster-llc-dba-eshyft-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 20, 2025
- Raw hash
- 649fb647986b7664bbc8fcf6b7d8f008520bc1b85c20641dc48b20fda335b51f
Reporting entity
- Name
- Shiftster LLCnorm: shiftster
Victim entity
- Name
- Shiftster LLCnorm: shiftster
Incident
- Discovered
- Mar 12, 2025
- Materiality determined
- —
- Notification sent
- Aug 5, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICPII
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 32 weeks(222 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.