HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

North Metro Harness Initiative

bd_17acf71d5a8be678 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 12, 2025

Filed

Dec 22, 2025

To disclose

19 weeks

Affected

3state residents only

Linked

6 filings

Confidence

64%

Full breach record for North Metro Harness Initiative →

North Metro Harness Initiative LLC dba Running Aces notified the NH Attorney General of a data security incident occurring between July 27 and August 14, 2025, detected on August 12, 2025. The breach impacted 3 New Hampshire residents, exposing names, SSNs, DOBs, and driver's license numbers. The company engaged third-party experts, notified law enforcement, and provided 12 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 16 days

discovery → filing · 19 weeks / 132 days

Jul 27, 2025

Begins

Aug 12, 2025

Discovered

Dec 22, 2025

Filed

vs. sector median

+11 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_01651db588c31fd12025-12-21 · +1dVerified
Massachusetts State AGbd_32911c01c826260b2025-12-21 · +1dVerified
Indiana State AGbd_d0e5768b81bad1d72025-12-19 · +3dVerified
Nebraska State AGbd_dcf1949f8b02bdf92025-12-19 · +3dVerified

Show 1 more filing ↓up to 28d gap

Idaho State AGbd_aa2c920d13eaf04c2025-11-24 · +28dCandidate

Name: North Metro Harness Initiative
norm: north metro harness initiative

Name: North Metro Harness Initiative
norm: north metro harness initiative
Also named: North Metro Harness Initiative, LLCdba oflegal entity
Running Acesdba oftrade name
Industry: Retail & Consumerllm

Discovered: Aug 12, 2025
Breach occurred: Jul 27, 2025 – Aug 14, 2025
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified NH Department of Justice
Initial access: exploit_public_facing

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Enhanced its data security
Commenced an investigation
Notified law enforcement regarding this incident
Engaged a national cybersecurity firm to assist in assessing the scope of the incident
Changes made: Enhanced network security and data privacy
Offering complimentary credit monitoring and identity protection services for twelve (12) months through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(132 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Idaho State AGNov 24 · first

Indiana State AG+25d

Nebraska State AG+25d

Maine State AG+27d

Massachusetts State AG+27d

New Hampshire State AG+28d · this page

Pattern: first filing Nov 24 (ID), last Dec 22 (NH) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/north-metro-harness-initiative-running-aces-20251222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2025
Raw hash: 2eb38f0757b711c9c402c6b4864f27d4b00d55dec4334a214fec816c147e493a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityNorth Metro Harness Initiative

Victim entityNorth Metro Harness Initiative

Incidentdiscovered Aug 12, 2025

Stated responseSecured and remediated the compromise

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov