HackingProfessional ServicesProfessional ServicesTargetedIdentity (basic)Government IDFinancial accountMediumContained

Smith Hawks

bd_012009b06105edba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 7, 2025

Filed

Feb 20, 2026

To disclose

15 weeks

Affected

10state residents only

Linked

6 filings

Confidence

66%

Full breach record for Smith Hawks →

Smith Hawks, P.L., a law firm, notified the New Hampshire Attorney General on Feb 20, 2026, of a data security event. The firm became aware of potential unauthorized access on Nov 7, 2025. The incident affected approximately 10 New Hampshire residents, exposing names, SSNs, driver's license numbers, and financial account information. Notifications were sent to affected individuals on Feb 13, 2026.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d15 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 15 weeks / 105 days

Nov 7, 2025

Discovered

Feb 20, 2026

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

A leak claim by worldleaks about this victim predates this filing by 65 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteworldleaksbd_7d09d3e1d3e9b4042025-12-16 · +65dVerified by operator

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_a0a7a31319c84e4a2026-02-13 · +7dVerified by operator
Indiana State AGbd_ffcdd2d5a5e9858d2026-02-13 · +7dVerified by operator
Massachusetts State AGbd_7d641c4d65b1e5ec2026-03-13 · +21dVerified by operator
Vermont State AGbd_ad4713bef02fda1f2026-04-29 · +68dVerified by operator

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Smith Hawks
norm: smith hawks
Domain: smithhawks.com
Industry: Professional Servicesllm

Discovered: Nov 7, 2025
Materiality determined: —
Notification sent: Feb 13, 2026
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Took immediate measures to secure the network
Launched an investigation to evaluate what happened
Undertook a review of all potentially affected data
Worked to gather contact information needed to provide notification
Notified the identified individuals
Provided them with information about its toll-free call center
Changes made: Implemented additional security measures to minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGFeb 13 · first

New Hampshire State AG+7d · this page

Massachusetts State AG+28d

Vermont State AG+75d

Pattern: first filing Feb 13 (IN), last Apr 29 (VT) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/smith-hawks-20260220.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2026
Raw hash: e38acb007b69a37f6e97987598c75ce96d03ff50244633fb009ce08acc618608

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entitySmith Hawks

Incidentdiscovered Nov 7, 2025

Stated responseTook immediate measures to secure the network

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov