Social EngineeringPhishingStolen CredentialsCustomer Data InvolvedTargetedIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIALMediumContained
NEW HAMPSHIRE HOUSING FINANCE AUTHORITY
bd_4263a68dfb0d7ac4 · schema v1 · pii pii-v1
Full breach record for NEW HAMPSHIRE HOUSING FINANCE AUTHORITY →New Hampshire Housing Finance Authority (NHHFA) reported a security incident where an employee's email account was accessed by an unauthorized individual on August 25, 2025. NHHFA discovered the breach on September 17, 2025. The attacker viewed mortgage application documents containing SSNs, DOBs, and income data. No data was downloaded. NHHFA secured the account, enhanced email security, and offered 24 months of Experian credit monitoring to affected individuals. Notification to NH AG was filed October 17, 2025.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/new-hampshire-housing-finance-authority-20251017.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 17, 2025
- Raw hash
- b59a982b2514b8d43adc8314b6badf3d0dd9e157f77921fd096d6074017e74f4
Reporting entity
- Name
- NEW HAMPSHIRE HOUSING FINANCE AUTHORITYnorm: new hampshire housing finance authority
Victim entity
- Name
- NEW HAMPSHIRE HOUSING FINANCE AUTHORITYnorm: new hampshire housing finance authority
Incident
- Discovered
- Sep 17, 2025
- Materiality determined
- —
- Notification sent
- Oct 14, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL
- Attack vector
- Phishing
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
- Initial access
- phishing_link
Compliance
- Time to disclose
- 4 weeks(30 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.