Social EngineeringPhishingCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Gateways Community Services
bd_34dd875a5baa7c44 · schema v1 · pii pii-v1
Full breach record for Gateways Community Services →Gateways Community Services, a New Hampshire nonprofit, notified the NH Attorney General of a cybersecurity incident discovered on February 2, 2026. The breach resulted from a phishing email that compromised an employee's email account, exposing Form W-2 data (names, addresses, SSNs, tax withholdings) for 689 individuals, including 627 NH residents. Gateways secured the account, engaged forensic investigators, implemented MFA and enhanced training, and offered 12 months of credit monitoring.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_9de941f2753722eeMaine State AGfiled 2026-05-05Verified
- bd_692469b3a2ef61f8Massachusetts State AGfiled 2026-05-01(4d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/gateways-community-services-20260505.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 5, 2026
- Raw hash
- 115039138a4cd5cf188d75cd7c034cb6669faaa1fcfa78a42cacf27a2af299e4
Reporting entity
- Name
- Gateways Community Servicesnorm: gateways community
Victim entity
- Name
- Gateways Community Servicesnorm: gateways community
Incident
- Discovered
- Feb 2, 2026
- Materiality determined
- —
- Notification sent
- May 5, 2026
- Affected individuals
- 689
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 13 weeks(92 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.