HackingRetail & ConsumerRetailTargetedIdentity (basic)MediumContained

Powerhouse Retail Services

bd_3dfe3ea201afe4b2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 22, 2026

Filed

Feb 3, 2026

To disclose

12 days

Affected · nationwide

7,85634 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Powerhouse Retail Services →4 incidents on file

Powerhouse Retail Services reported an external system breach (hacking) occurring on September 20, 2023, discovered on January 22, 2026. The incident affected 7,856 individuals nationwide, including 34 Maine residents. Impacted data included names and other personal identifiers. The company engaged external cybersecurity professionals and offered 12 months of credit monitoring and identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 22, 2026 → Filed with AG Feb 3, 202612d ✓ ME AG ≤30d12 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 855 days

discovery → filing · 12 days

Sep 20, 2023

Begins

Jan 22, 2026

Discovered

Feb 3, 2026

Filed

vs. sector median

6 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_3f4af44caafcf9ae2026-02-03Verified
Vermont State AGbd_512c8d67b1e6aac02026-02-03Verified
Massachusetts State AGbd_6070d226563cff5d2026-02-03Verified
Nebraska State AGbd_adbf653025b274ee2026-02-03Verified

Show 2 more filings ↓up to 6d gap

Texas State AGbd_485a778092cf2cca2026-02-04 · +1dVerified
New Hampshire State AGbd_26e229a4b8303bad2026-02-09 · +6dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Powerhouse Retail Services
norm: powerhouse retail
Domain: powerhousenow.com
Industry: Retail & Consumerllm

Discovered: Jan 22, 2026
Breach occurred: Sep 20, 2023
Undetected for: 855 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2026
Affected individuals: 7,856state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering a complimentary 12-month membership of Epiq – Privacy Solutions ID 1B Credit Monitoring - Plus
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: ME AG ≤30d · 12d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 22, 2026
→ Filed with AG: Feb 3, 2026
12d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 22, 2026 → Filed with AG: Feb 3, 2026	12d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGFeb 3 · first

Vermont State AGFeb 3 · first

Massachusetts State AGFeb 3 · first

Nebraska State AGFeb 3 · first

Maine State AGFeb 3 · first · this page

Texas State AG+1d

New Hampshire State AG+6d

Pattern: first filing Feb 3 (IN), last Feb 9 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6fd7501f-5bfa-475e-825d-e4dd46387026.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2026
Raw hash: 1198d50ec56b5b4abd18ca8678e287365b3d87852b162ade98d4b74e661c7fac

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityPowerhouse Retail Services

Incidentdiscovered Jan 22, 2026

Stated responseCommenced a prompt and thorough investigation

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov