HackingRetail & ConsumerRetailStolen CredentialsVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountCredentialsMediumContained

H&H Color Lab

bd_390908f440605a15 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2025

Filed

Jan 13, 2026

To disclose

24 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for H&H Color Lab →

H&H Color Lab, Inc. notified the New Hampshire Attorney General of a security incident affecting two NH residents. Unauthorized access occurred on July 30, 2025, detected on July 31, 2025. Impacted data included names, SSNs, driver's licenses, health insurance numbers, financial account numbers, and usernames/passwords. The company engaged forensic experts, reset passwords, rebuilt servers, and provided one year of credit monitoring. Notification was mailed on January 13, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 24 weeks / 166 days

Jul 30, 2025

Begins

Jul 31, 2025

Discovered

Jan 13, 2026

Filed

vs. sector median

+16 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_62c63dc3b1e2c28d2026-01-13Verified
Nebraska State AGbd_7dfb4322c4d2c1e92026-01-13Verified
Massachusetts State AGbd_97c30413c89336612026-01-14 · +1dVerified

Name: H&H Color Lab
norm: h h color lab

Name: H&H Color Lab
norm: h h color lab
Industry: Retail & Consumerllm

Discovered: Jul 31, 2025
Breach occurred: Jul 30, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 13, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged Shook, Hardy & Bacon, LLP as outside counsel
Engaged a leading digital-forensics firm to assist in the investigation
Notified employees
Hired a data-review company to examine the compromised files
Notified law enforcement
Established a toll-free call center
Changes made: Reset passwords
Rebuilt the affected servers
Adopted additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(166 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJan 13 · first

Nebraska State AGJan 13 · first

New Hampshire State AGJan 13 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/h-h-color-lab-20260113.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 13, 2026
Raw hash: 9a5527762c8e5671fb186287c3826a9673d7c65ebe9fddda0bcc82f9982acfeb

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityH&H Color Lab

Victim entityH&H Color Lab

Incidentdiscovered Jul 31, 2025

Stated responseEngaged Shook, Hardy & Bacon, LLP as outside counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov