HackingManufacturingCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPIIMediumContained

EASYPAK, LLC

bd_4d3d13430a2b9809 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 13, 2026

Filed

Jul 8, 2026

To disclose

25 weeks

Affected

217state residents only

Linked

2 filings

Confidence

67%

Full breach record for EASYPAK, LLC →

G-Pak Holdings, LLC DBA Easypak notified affected individuals of unauthorized network access discovered on January 13, 2026. The incident involved access to files containing names and PII. Easypak engaged external cybersecurity professionals and is offering complimentary credit monitoring services to affected individuals across multiple states, including Massachusetts, Connecticut, Maryland, New York, and Rhode Island.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d25 weeks discovery → filing

Incident timeline

discovery → filing · 25 weeks / 176 days

Jan 13, 2026

Discovered

Jul 8, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 176 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_198784382bd6ada32026-01-13 · +176dCandidate

Name: EASYPAK, LLC
norm: easypak
Domain: easypak.com

Name: EASYPAK, LLC
norm: easypak
Domain: easypak.com
Also named: G-Pak Holdings, LLCdba oflegal entity
Easypakdba oftrade name

Discovered: Jan 13, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 217state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email Collection
Threat actor: External

During the incident: Worked very closely with external cybersecurity professionals
Providing you with access to [XXX] (#) months of [credit monitoring service]
Changes made: Continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(176 days from discovery to filing)
Compliance flags: MA AG >90dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1098-g-pak-holdings-llc-dba-easypak/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2026
Raw hash: f4f160eb61b2f560f0f34cbc06b29f76a382992b90060db491159c9747f542d2

Linked disclosures

Ransomware claims (1)

Reporting entityEASYPAK, LLC

Victim entityEASYPAK, LLC

Incidentdiscovered Jan 13, 2026

Stated responseWorked very closely with external cybersecurity professionals

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov