HackingManufacturingManufacturingStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

U.S. Duct, Inc.

bd_5926e66c0d656582 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2026

Filed

Apr 24, 2026

To disclose

14 weeks

Affected

1state residents only

Confidence

66%

U.S. Duct, Inc. notified the New Hampshire AG that on Jan 15, 2026, an unauthorized third party accessed its network. The incident was contained. Analysis confirmed access to employee/dependent PII (name, DOB, SSN). One NH resident affected. Remediation included credential resets, monitoring, and 12 months of credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 99 days

Jan 15, 2026

Discovered

Apr 24, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: U.S. Duct, Inc.
norm: u.s. duct
Domain: usaduct.com

Name: U.S. Duct, Inc.
norm: u.s. duct
Domain: usaduct.com
Industry: Manufacturingllm

Discovered: Jan 15, 2026
Materiality determined: —
Notification sent: Apr 20, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: valid_credentials

During the incident: Launched a comprehensive investigation
Blocked further activity on the network and contained the incident
Took steps to rebuild its systems and reestablish safe network environments
Implemented additional safeguards
Undertook an extensive analysis of the affected systems
Updated authorized users' credentials
Forced password resets
Adding additional monitoring and detection tools as safeguards
Changes made: Offering 12 months of credit monitoring and identity theft restoration services
Enhanced cybersecurity by updating authorized users' credentials
Forcing password resets
Adding additional monitoring and detection tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(99 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/us-duct-20260424.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2026
Raw hash: c519fbbb52df9b47b3ef62b1ef59ed46a020733b073255fb1ebeb606e1056462

Reporting entityU.S. Duct, Inc.

Victim entityU.S. Duct, Inc.

Incidentdiscovered Jan 15, 2026

Stated responseLaunched a comprehensive investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov