HackingOtherSkimmerSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountLowContained

The Woodlands Arts Council

bd_418ae63c13e7184f · schema v1 · pii pii-v2

Severity

Low

Discovered

Aug 7, 2026

Filed

Sep 30, 2026

To disclose

8 weeks

Affected

2state residents only

Linked

4 filings

Confidence

69%

Full breach record for The Woodlands Arts Council →2 incidents on file

The Woodlands Arts Council notified the NH Attorney General of a data event affecting 2 NH residents. Malicious code placed on the website by a third-party vendor potentially copied payment card data from Dec 9, 2025 to Aug 7, 2026. The incident was discovered on Aug 7, 2026. Affected data includes names and payment card information. The organization is reviewing vendors and policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 241 days

discovery → filing · 8 weeks / 54 days

Dec 9, 2025

Begins

Aug 7, 2026

Discovered

Sep 30, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_cf050faac9d9f9182026-09-30Candidate
Vermont State AGbd_e4841324cfbe5b2c2026-09-30Verified
Texas State AGbd_9d26f1252a8b985d2026-10-02 · +2dVerified

Name: The Woodlands Arts Council
norm: the woodlands arts council
Domain: thewoodlandsartscouncil.org

Name: The Woodlands Arts Council
norm: the woodlands arts council
Domain: thewoodlandsartscouncil.org
Industry: Otherllm

Discovered: Aug 7, 2026
Breach occurred: Dec 9, 2025 – Aug 7, 2026
Undetected for: 241 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 30, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Provided written notice of this incident to relevant state regulators
Third party: via third-party website vendor
Initial access: supply_chain

During the incident: Promptly launched an investigation into the nature and scope of the activity, working with its website vendor
Analyzed its transaction records and determined the list of potential impacted individuals
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided individuals with information on how to place a fraud alert and security freeze on one’s credit file
Provided written notice of this incident to relevant state regulators
Changes made: Reviewing our existing vendors, policies, and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 30 · first

Vermont State AGSep 30 · first

New Hampshire State AGSep 30 · first · this page

Texas State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/woodlands-art-council-20260930.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 30, 2026
Raw hash: 5552f3a4e0b41f90f47cb5391bb3b5dc5a38f057b6f44046a10195a29079dbe5

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe Woodlands Arts Council

Victim entityThe Woodlands Arts Council

Incidentdiscovered Aug 7, 2026

Stated responsePromptly launched an investigation into the nature and scope of the activity, working with its website vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov