HackingTechnologyInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

News-Press and Gazette Co.

bd_64689afdb11b1fc1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 4, 2025

Filed

Dec 22, 2025

To disclose

16 weeks

Affected

8state residents only

Linked

12 records

Confidence

66%

Full breach record for News-Press and Gazette Co. →2 incidents on file

News-Press & Gazette Company notified the New Hampshire Attorney General of unauthorized network access affecting 8 NH residents. Suspicious activity was detected on September 4, 2025, involving access to names, SSNs, and DOBs between September 2 and 25, 2025. The company engaged forensic investigators, confirmed the scope on November 17, 2025, and began notifying residents on December 17, 2025, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 16 weeks / 109 days

Sep 2, 2025

Begins

Sep 4, 2025

Discovered

Dec 22, 2025

Filed

vs. sector median

+5 wks slower

This filing is one of 12 records about the same incident.View merged incident

A leak claim by termite about this victim was first seen 97 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (4)

Leak Sitetermitebd_c681fc7e45582d1d2025-09-29 · +83dVerified by operator
Leak Sitetermitebd_d0924a09fd8294e12025-09-26 · +86dVerified by operator
Leak Sitetermitebd_ba66d48d79cf258f2025-09-26 · +86dVerified by operator
Leak Sitetermitebd_5aba6d22aacc88a42025-09-26 · +87dVerified by operator

Regulatory filings (6) · sorted by filing gap

Washington State AGbd_0babd26da49a0e0d2025-12-17 · +5dVerified by operator
Texas State AGbd_4cf2ede58f3d3b7d2025-12-17 · +5dVerified by operator
California State AGbd_5d92baf95234282a2025-12-17 · +5dVerified by operator
Oregon State AGbd_6038362158479cb92025-12-17 · +5dVerified by operator

Show 2 more filings ↓up to 5d gap

Indiana State AGbd_85c7765e2d5b7a3c2025-12-17 · +5dVerified by operator
Massachusetts State AGbd_e351340a5aaae3432025-12-17 · +5dVerified by operator

Showing first 10 of 11 linked disclosures.

Name: News-Press and Gazette Co.
norm: news press and gazette
Domain: npgco.com

Name: News-Press and Gazette Co.
norm: news press and gazette
Domain: npgco.com
Industry: Technologyllm

Discovered: Sep 4, 2025
Breach occurred: Sep 2, 2025 – Sep 25, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 17, 2025
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Engaged professional experienced in handling these types of incidents to assist with an investigation and to assess the full scope of information impacted
Provided notice to the affected residents commencing on December 17, 2025
Offered complimentary credit monitoring to individuals that had their Social Security number potentially impacted
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Washington State AGDec 17 · first

Texas State AGDec 17 · first

California State AGDec 17 · first

Oregon State AGDec 17 · first

Indiana State AGDec 17 · first

Massachusetts State AGDec 17 · first

New Hampshire State AG+5d · this page

Pattern: first filing Dec 17 (WA), last Dec 22 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/news-press-gazette-20251222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2025
Raw hash: 67634682417491066d2ded4f78d8bd1760173e486ba5ce01e50b82907ea075be

Linked disclosures

Ransomware claims (4)

Regulatory filings (6) · sorted by filing gap

Reporting entityNews-Press and Gazette Co.

Victim entityNews-Press and Gazette Co.

Incidentdiscovered Sep 4, 2025

Stated responseEngaged professional experienced in handling these types of incidents to assist with an investigation and to assess the full scope of information impacted

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov