HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

First Meridian Services Inc

bd_1038558d8503c665 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2025

Filed

Feb 9, 2026

To disclose

22 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for First Meridian Services Inc →2 incidents on file

First Meridian Services, Inc. notified the New Hampshire Attorney General of a security event affecting two NH residents. On September 5, 2025, suspicious activity was detected; an unauthorized third party gained access and exfiltrated files containing names, Social Security numbers, and driver's license numbers. Notices were mailed on February 10, 2026, offering 12 months of credit monitoring. The company strengthened security controls and audited permissions.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 22 weeks / 157 days

Sep 1, 2025

Begins

Sep 5, 2025

Discovered

Feb 9, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_24e12fae31f57e9c2026-02-10 · +1dCandidate
Nebraska State AGbd_6e7cc95c1728277a2026-02-10 · +1dVerified

Name: First Meridian Services Inc
norm: first meridian

Name: First Meridian Services Inc
norm: first meridian
Industry: Retail & Consumerllm

Discovered: Sep 5, 2025
Breach occurred: Sep 1, 2025 – Sep 7, 2025
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 10, 2026
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged outside counsel
Retained cybersecurity experts to conduct a forensic investigation
Engaged a data-review firm to determine the contents of the affected files
Validated current addresses for individuals possibly entitled to notice
Mailed notices to affected individuals
Offered 12 months of complimentary credit monitoring
Changes made: Strengthened passwords
Expanded server monitoring
Audited account permissions
Evaluated additional endpoint detection
Updated network security controls
Reassessed account privileges
Added more segmentation
Moved sensitive data to more secure environments
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(157 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGFeb 9 · first · this page

Indiana State AG+1d

Nebraska State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/first-meridian-services-20260209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2026
Raw hash: b05e923b8d81a5dd9930f4c949edd4692ac237b7e1be4457cbc8194449a80bd7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFirst Meridian Services Inc

Victim entityFirst Meridian Services Inc

Incidentdiscovered Sep 5, 2025

Stated responseEngaged outside counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov