Social EngineeringBECPhishingData ExfiltratedCustomer Data InvolvedTargetedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
J.M. Forbes & Co.
bd_66f15480d78ef9f6 · schema v1 · pii pii-v1
Full breach record for J.M. Forbes & Co. →JM Forbes & Co., a wealth management firm, notified the New Hampshire Attorney General of a security incident affecting 19 residents. On November 17, 2025, suspicious activity was detected on an employee email account. Investigation determined unauthorized access occurred via social engineering (business email compromise). Affected data included names, addresses, SSNs, and account numbers. No fraudulent transactions occurred. JMF provided two years of credit monitoring and enhanced safeguards.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_2d8fdc40759510b0Vermont State AGfiled 2026-04-07Candidate
- bd_ba4b31877e8d09b1Maine State AGfiled 2026-04-07Verified by operator
- bd_a5dc2e414705c04dNew Hampshire State AGfiled 2026-07-06(90d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/jm-forbes-20260407.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 7, 2026
- Raw hash
- 93ebe0f196a5c1c35fca6338daac60252785196b24d7114725ff4267bf8d2ccd
Reporting entity
- Name
- J.M. Forbes & Co.norm: jm forbes
- Domain
- jmforbes.com
Victim entity
- Name
- J.M. Forbes & Co.norm: jm forbes
- Domain
- jmforbes.com
Incident
- Discovered
- Nov 17, 2025
- Materiality determined
- —
- Notification sent
- Apr 7, 2026
- Affected individuals
- 19
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified regulators in other states where affected individuals are resident
- Initial access
- phishing_link
Compliance
- Time to disclose
- 20 weeks(141 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.