HackingManufacturingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

pewag

bd_484f9ae9b9ef33d3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 8, 2026

Filed

May 15, 2026

To disclose

5 weeks

Affected

16state residents only

Linked

3 filings

Confidence

66%

Full breach record for pewag →

pewag, Inc. notified the NH Attorney General of a data event discovered on April 8, 2026, where an unauthorized individual copied information. 16 New Hampshire residents were affected, with exposure of names, SSNs, driver's license/passport numbers, financial account numbers, and health insurance/medical information. The company engaged forensic experts and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 37 days

Apr 8, 2026

Begins

Apr 8, 2026

Discovered

May 15, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_373cb109f9451d662026-05-15Candidate
Indiana State AGbd_ac479561543e9d712026-05-15Verified

Name: pewag
Domain: pewag.com

Name: pewag
Domain: pewag.com

Discovered: Apr 8, 2026
Breach occurred: Apr 8, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 15, 2026
Affected individuals: 16state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unknown
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General

During the incident: Engaged a specialized cybersecurity firm to conduct a privileged forensic investigation
Informed its law firm and began identifying the affected individuals in preparation for notice
Offered at least 12 months of complimentary credit monitoring and identity theft restoration services through Cyberscout/TransUnion
Provided guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGMay 15 · first

Indiana State AGMay 15 · first

New Hampshire State AGMay 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pewag-20260515.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 15, 2026
Raw hash: cbb079f24a04bbd022ff2c455048fbc8d9e9ce10339d8b4e6cfe0347b39552ff

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitypewag

Victim entitypewag

Incidentdiscovered Apr 8, 2026

Stated responseEngaged a specialized cybersecurity firm to conduct a privileged forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov