HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICMediumContained
Hy LaBonne & Sons, Inc.
bd_13e830a3f51e82b9 · schema v1 · pii pii-v1
Full breach record for Hy LaBonne & Sons, Inc. →Hy LaBonne & Sons, Inc. (dba LaBonne's Markets) notified the New Hampshire Attorney General on May 5, 2026, of a cybersecurity incident discovered on October 20, 2025. Unauthorized access resulted in the exfiltration of names, Social Security numbers, and medical information for 16 New Hampshire residents. The company engaged forensic specialists, notified federal law enforcement, and provided 24 months of credit monitoring via Experian.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_62c561375abf8b85Indiana State AGfiled 2026-05-05Verified
- bd_89a60533b8b5625fVermont State AGfiled 2026-05-05Verified
- bd_c05fb4c6e606bf09Maine State AGfiled 2026-05-05Verified
- bd_84a5bffe6193242eMassachusetts State AGfiled 2026-05-01(4d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/hy-labonne-sons-labonnes-markets-20260505.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 5, 2026
- Raw hash
- 4b34089df19f8ea278e95bbbfc099a70be3a35ced432ae8538002e3d361e1a00
Reporting entity
- Name
- Hy LaBonne & Sons, Inc.norm: hy labonne sons
Victim entity
- Name
- Hy LaBonne & Sons, Inc.norm: hy labonne sons
Incident
- Discovered
- Oct 20, 2025
- Materiality determined
- —
- Notification sent
- May 5, 2026
- Affected individuals
- 16
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified federal law enforcementProvided written notice of this event to potentially affected individualsProviding written notice of this event to appropriate state regulators
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 28 weeks(197 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.