HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICFINANCIAL_ACCOUNTLowContained
H2 Builders
bd_3eced92683a1d585 · schema v1 · pii pii-v1
Full breach record for H2 Builders →H2 Builders LLC notified the New Hampshire Attorney General of a cybersecurity incident occurring between September 29 and October 6, 2025. Unauthorized access to H2's internal network resulted in the potential acquisition of personal information, including names and financial account details, affecting a limited number of New Hampshire residents. H2 contained the incident, engaged forensic experts, and began notifying affected individuals on or about April 13, 2026.
Leak gap clock⏱ Leak >90d14 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
A leak claim by akira about this victim predates this filing by 103 days.View originating leak claim
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/h2-builders-20260427.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 27, 2026
- Raw hash
- 9d9cf073e75a2321e396a8b1c57a0738e6cfb338202d985a0de91324bd691fce
Reporting entity
- Name
- MCDONALD HOPKINS LLCnorm: mcdonald hopkins
Victim entity
- Name
- H2 Buildersnorm: h2 builders
- Domain
- h2builders.com
Incident
- Discovered
- Apr 13, 2026
- Materiality determined
- —
- Notification sent
- Apr 13, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Office of the Attorney General, Consumer Protection Bureau
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 days(14 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.