HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)MediumContained

The Legal Aid Society

bd_0bccdb0fce981dbe · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 9, 2026

Filed

Oct 15, 2026

To disclose

5 weeks

Affected

2state residents only

Confidence

69%

Full breach record for The Legal Aid Society →3 incidents on file

The Legal Aid Society notified the NH Attorney General that an unauthorized actor accessed a limited number of email accounts between March 13, 2025, and August 1, 2025. On September 9, 2026, following forensic investigation, the organization determined that personal information of two New Hampshire residents, including full names, Social Security numbers, and health insurance information, was potentially compromised. The organization contained the threat, secured its email environment, engaged external cybersecurity professionals, and is offering one year of complimentary credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 545 days

discovery → filing · 5 weeks / 36 days

Mar 13, 2025

Begins

Sep 9, 2026

Discovered

Oct 15, 2026

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: The Legal Aid Society
norm: the legal aid society

Name: The Legal Aid Society
norm: the legal aid society
Industry: Professional Servicesllm

Discovered: Sep 9, 2026
Breach occurred: Mar 13, 2025 – Aug 1, 2025
Undetected for: 545 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 8, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General

During the incident: Worked to contain the threat
Secured its email environment
Commenced a prompt and thorough investigation
Worked closely with external cybersecurity professionals
Provided notification of this incident
Offering the affected residents with complimentary one-year membership with a credit monitoring service
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/legal-aid-society-20261015.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2026
Raw hash: eb3ecc60f518dc923bf2890b9de5efb0759b212db4278b63593e5cc1615cb41b

Reporting entityThe Legal Aid Society

Victim entityThe Legal Aid Society

Incidentdiscovered Sep 9, 2026

Stated responseWorked to contain the threat

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov