H2O.AI, INC.

H2O.ai notified the Maryland Attorney General that a financially motivated threat actor accessed H2O systems between December 20, 2024, and January 29, 2025. The incident affected 12 Maryland residents, exposing payroll, SSNs, driver's license numbers, and addresses. H2O retained cybersecurity firms, reported to law enforcement, took the environment offline, and implemented enhanced monitoring.

H2O.ai experienced an external system breach (hacking) between Dec 20, 2024, and Jan 29, 2025. Discovered Feb 18, 2025, after a financially motivated group claimed to have stolen data. 734 individuals affected, including 1 Maine resident. Data included names, SSNs, driver's licenses, and financial info. H2O retained cybersecurity firms, notified law enforcement, and enhanced network security. Offered 12 months of Experian IdentityWorks.

H2O.ai reported a data breach to the Indiana Attorney General. The breach occurred on 2024-12-20 and was reported on 2025-03-27. 1 Indiana residents were affected. 734 individuals affected in total.

H2O.ai reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-03-27. 4 Massachusetts residents were affected.

As a result of our operation, we have discovered the following concerning data: 1. Unanonymized customer datasets intended for AI training. 2. Full source code of programs from the Git repository, including code for driverless systems, GPT models, and others. 3. A substantial amount of internal information, including contracts, customer personal data, project costs, and project documentation. 4. Backup copies of employee email accounts containing customer correspondence.