HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

Brooks Cook and Associates, LLC

bd_1b541917d105bb19 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 6, 2025

Filed

Jul 9, 2026

To disclose

31 weeks

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for Brooks Cook and Associates, LLC →

Brooks, Cook & Associates notified the NH Attorney General of a cybersecurity incident where a third-party data center provider was compromised on December 6, 2025. Unauthorized access occurred on the same date. The company discovered the incident on December 6, 2025, and determined on April 17, 2026, that the name and Social Security numbers of two New Hampshire residents were accessed. Notification letters were mailed on July 9, 2026. The company secured the network, notified law enforcement, and enhanced security measures.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 31 weeks / 215 days

Dec 6, 2025

Begins

Dec 6, 2025

Discovered

Jul 9, 2026

Filed

vs. sector median

+13 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_3c0bee5769df6e4d2026-07-09Candidate
Massachusetts State AGbd_b27a906e318021732026-07-09Verified

Name: Brooks Cook and Associates, LLC
norm: brooks cook and associates
Domain: bca-cpa.com

Name: Brooks Cook and Associates, LLC
norm: brooks cook and associates
Domain: bca-cpa.com
Industry: Professional Servicesllm

Discovered: Dec 6, 2025
Breach occurred: Dec 6, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 9, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Third party: via data center provider
Initial access: supply_chain

During the incident: Took steps to secure the network
Launched an investigation into the matter
Notified law enforcement of the incident
Established a dedicated call center
Changes made: Taken steps to enhance its existing security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(215 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGJul 9 · first

Massachusetts State AGJul 9 · first

New Hampshire State AGJul 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/brooks-cooks-associates-20260709.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2026
Raw hash: 18c66f38787902a7b897765d77e53c895626eac78bdbeace04f1cad40be974c1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBrooks Cook and Associates, LLC

Victim entityBrooks Cook and Associates, LLC

Incidentdiscovered Dec 6, 2025

Stated responseTook steps to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov