MalwareManufacturingManufacturingRansomwareData EncryptedTargetedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Form Energy

bd_06e38dc0ce98a381 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 16, 2025

Filed

Oct 28, 2025

To disclose

6 weeks

Affected

23state residents only

Linked

5 filings

Confidence

67%

Full breach record for Form Energy →

Form Energy, Inc. notified the New Hampshire Attorney General of a ransomware attack discovered on September 16, 2025. The incident impacted 23 New Hampshire residents (employees and beneficiaries), exposing PII including names, addresses, SSNs, and bank account numbers. Form Energy took systems offline, engaged forensic experts, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 42 days

Sep 16, 2025

Discovered

Oct 28, 2025

Filed

vs. sector median

5 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_0ec61d0f2e01963a2025-10-28Verified
California State AGbd_f409baa0ef1fccd72025-10-28Candidate
Nebraska State AGbd_44472179b6c665782025-10-22 · +6dVerified
California State AGbd_1919c4dafc469d102025-11-14 · +17dCandidate

Name: DUANE MORRIS LLP
norm: duane morris

Name: Form Energy
norm: form energy
Domain: formenergy.com
Industry: Manufacturingllm

Discovered: Sep 16, 2025
Materiality determined: —
Notification sent: Oct 22, 2025
Affected individuals: 23state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General

During the incident: Took affected systems offline
Engaged external cybersecurity experts
Launched an investigation
Began remediation activities
Changes made: Provided complimentary credit monitoring and identity theft prevention services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Nebraska State AGOct 22 · first

Massachusetts State AG+6d

California State AG+6d

New Hampshire State AG+6d · this page

California State AG+23d

Pattern: first filing Oct 22 (NE), last Nov 14 (CA) — a 23-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/form-energy-20251028.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2025
Raw hash: 06e170744c085570c9eb484cd9891e70e4950e53964d913bf0400ff7e2bfc3d4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityDUANE MORRIS LLP

Victim entityForm Energy

Incidentdiscovered Sep 16, 2025

Stated responseTook affected systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov