HackingRetail & ConsumerRetailCustomer Data InvolvedIdentity (basic)LowContained

Donelan's Supermarkets, Inc.

bd_2d1ce5b3eb4d1f9b · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 14, 2025

Filed

Nov 17, 2025

To disclose

14 weeks

Affected

19state residents only

Linked

3 filings

Confidence

67%

Full breach record for Donelan's Supermarkets, Inc. →

Donelan’s Supermarkets, Inc. detected a network security incident on August 14, 2025, where an unauthorized third party accessed its network environment. The investigation determined that certain personal information, specifically first and last names, was acquired. 19 New Hampshire residents were affected. The company engaged forensic specialists, wiped and rebuilt affected systems, notified the FBI, and is offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 95 days

Aug 14, 2025

Discovered

Nov 17, 2025

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_a584fb44ccf03ddf2025-11-17Candidate
Massachusetts State AGbd_a83e3229dbc5d6e72025-11-17Verified

Name: Donelan's Supermarkets, Inc.
norm: donelan s supermarkets

Name: Donelan's Supermarkets, Inc.
norm: donelan s supermarkets
Industry: Retail & Consumerllm

Discovered: Aug 14, 2025
Materiality determined: —
Notification sent: Nov 17, 2025
Affected individuals: 19state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBI

During the incident: Engaged third-party forensic specialists to assist with securing the network environment and investigating the extent of any unauthorized activity
Confirmed the security of our box.com environment
Wiped and rebuilt affected systems
Notified the FBI and are fully cooperating with their investigation
Changes made: Taken steps to bolster our network security
Reviewing and altering our policies, procedures, and network security software relating to the security of our systems and servers, as well as how we store and manage data
Offering free credit monitoring and identity theft protection through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(95 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGNov 17 · first

Massachusetts State AGNov 17 · first

New Hampshire State AGNov 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/donelans-supermarkets-20251117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2025
Raw hash: 5b3e1a0b344bfc62d34e11810b516c9bb00418dd672279f0a4aaef5e5602b1ef

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDonelan's Supermarkets, Inc.

Victim entityDonelan's Supermarkets, Inc.

Incidentdiscovered Aug 14, 2025

Stated responseEngaged third-party forensic specialists to assist with securing the network environment and investigating the extent of any unauthorized activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov