MalwareManufacturingManufacturingRansomwareData ExfiltratedData EncryptedTargetedIdentity (basic)Government IDMediumContained

Bronze Craft

bd_273680564f894680 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 30, 2025

Filed

Oct 3, 2025

To disclose

14 weeks

Affected

170state residents only

Confidence

63%

Full breach record for Bronze Craft →3 incidents on file

Bronze Craft Corporation notified the New Hampshire AG of a ransomware incident where systems were locked and files copied without permission between June 17-21, 2025. The company discovered the incident on June 30, 2025, and notified 170 NH residents on October 2, 2025. Compromised data included names, SSNs, and driver's license numbers. BCC restored systems from backups and provided 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d14 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 13 days

discovery → filing · 14 weeks / 95 days

Jun 17, 2025

Begins

Jun 30, 2025

Discovered

Oct 3, 2025

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed170 affectedView incident

A leak claim by qilin about this victim predates this filing by 103 days.View originating leak claim

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Bronze Craft
norm: bronze craft
Domain: bronzecraft.com
Industry: Manufacturingllm

Discovered: Jun 30, 2025
Breach occurred: Jun 17, 2025 – Jun 21, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2025
Affected individuals: 170state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney General Consumer Protection & Antitrust Bureau

During the incident: Briefly took the systems offline
Securely restored the systems from backups
Reviewed this matter further
Undertook a review of those files to determine what information was in them, and to whom the information related
Provided written notice of this matter to approximately one hundred seventy (170) New Hampshire residents
Providing access to identity monitoring services for one (1) year, through TransUnion, to notified individuals at no cost
Providing notified individuals with guidance on how to better protect against identity theft and fraud
Changes made: Taking steps to evaluate and update its policies and practices to mitigate the risk of a matter like this reoccurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bronze-craft-20251003.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 3, 2025
Raw hash: edb6a59c485f3606d72d23c3678de885b26173702045694385d2df26f3bac26d

Reporting entityMullen Coughlin LLC

Victim entityBronze Craft

Incidentdiscovered Jun 30, 2025

Stated responseBriefly took the systems offline

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov