HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
NCH CORPORATION
bd_2a8be8acf60543c6 · schema v1 · pii pii-v1
Full breach record for NCH CORPORATION →NCH Corporation notified the New Hampshire Attorney General of a breach affecting 10 state residents. Unauthorized access occurred between January 21 and February 25, 2026. The company discovered the incident on March 9, 2026. Files containing names, SSNs, DOBs, and benefits info were exfiltrated. NCH offered one year of IDX identity monitoring and enhanced security measures.
Leak gap clock⏱ Leak >90d8 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
A leak claim by cl0p about this victim predates this filing by 160 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_4194fd4f05a95e97Vermont State AGfiled 2026-05-01Verified
- bd_b1ef5142cadc5124Indiana State AGfiled 2026-05-01Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/nch-corporation-20260501.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- c91ad82aff7ff994f27967fcaf9f993319c05ce5c2bb4355ab8215f67fca89d7
Reporting entity
- Name
- NCH CORPORATIONnorm: nch
- Domain
- nch.com
Victim entity
- Name
- NCH CORPORATIONnorm: nch
- Domain
- nch.com
Incident
- Discovered
- Mar 9, 2026
- Materiality determined
- —
- Notification sent
- May 1, 2026
- Affected individuals
- 10
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 8 weeks(53 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.