MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)MediumContained

Grace Design Studios

bd_37da45569399d16d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 6, 2026

Filed

May 7, 2026

To disclose

9 weeks

Affected

1state residents only

Linked

3 records

Confidence

67%

Full breach record for Grace Design Studios →

AEC Holdco, LLC d/b/a Grace Design Studios, LLC, a Louisiana architecture and design firm, reported a ransomware incident to the New Hampshire Attorney General. The company discovered unauthorized access on March 6, 2026, which involved the encryption of systems and exfiltration of employee personal information, including names and Social Security numbers. One New Hampshire resident was identified. The company took systems offline, engaged forensic investigators, and notified the affected individual on April 30, 2026, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 62 days

Mar 6, 2026

Discovered

May 7, 2026

Filed

vs. sector median

11 wks faster

This filing is one of 3 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepayoutskingbd_f0504f33d93978152026-03-09 · +59dVerified by operator

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_ca410ec9e53f7db32026-04-30 · +7dVerified by operator

Name: Grace Design Studios
norm: grace design studios
Domain: grace-design.com

Name: Grace Design Studios
norm: grace design studios
Domain: grace-design.com
Also named: AEC Holdco, LLCdba oflegal entity
Grace Design Studios, LLCdba oftrade name
Industry: Professional Servicesllm

Discovered: Mar 6, 2026
Materiality determined: —
Notification sent: Apr 30, 2026
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported to New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Taking its systems offline
Deploying end-point detection and response tools
Retaining cybersecurity professionals to investigate the incident
Notified the New Hampshire resident via U.S. mail on April 30, 2026
Offered an opportunity to enroll in twelve (12) months of complimentary credit monitoring and identity protection services through Kroll or Haystack
Changes made: Reviewing its existing security policies and protections
Adopting additional security to safeguard against evolving threats moving forward
Redesigning our network and infrastructure using a tiered admin system
Implementing a SIEM
Refining Cynet alerts
Developing WISP policies and safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGApr 30 · first

New Hampshire State AG+7d · this page

Pattern: first filing Apr 30 (IN), last May 7 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/aec-holdco-grace-design-studios-20260507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2026
Raw hash: ce5edaac95856f1fcf01c82be8bd05b914d52b48d5e5f03d61c6f1bd5e14280b

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityGrace Design Studios

Victim entityGrace Design Studios

Incidentdiscovered Mar 6, 2026

Stated responseTaking its systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov