HackingCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
ZACHARY CONFECTIONS, INC.
bd_67151c1c4365d75f · schema v1 · pii pii-v1
Full breach record for ZACHARY CONFECTIONS, INC. →Zachary Confections, Inc. notified Massachusetts residents of a cybersecurity incident occurring on April 20, 2026, where unauthorized parties may have acquired files containing names and Social Security numbers. The company engaged cybersecurity experts, rebuilt affected systems, and offered free credit monitoring and fraud assistance through Cyberscout (TransUnion). No evidence of misuse was found.
Massachusetts clock✓ MA AG ≤30d11 days discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_e7dc23f5c5d9d6eeIndiana State AGfiled 2026-05-28(27d gap)Verified
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-874-zachary-confections-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- e4f2ee11207f75225aa514cdeeb88bee13506fb6a3eaf7d489a52be6619ef993
Reporting entity
- Name
- ZACHARY CONFECTIONS, INC.norm: zachary confections
Victim entity
- Name
- ZACHARY CONFECTIONS, INC.norm: zachary confections
Incident
- Discovered
- Apr 20, 2026
- Materiality determined
- —
- Notification sent
- May 28, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 11 days(11 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.