HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDMediumContained

AILCO

bd_6c5086c2a4ac0cd7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 11, 2026

Filed

Mar 26, 2026

To disclose

6 weeks

Affected · nationwide

5382 in this filing

Linked

4 filings

Confidence

66%

Full breach record for AILCO →

Ailco Equipment Finance Group, Inc. notified the NH Attorney General of a breach involving its third-party provider, Kaaj Technologies Inc. Unauthorized access occurred on January 13, 2026, resulting in the copying of applicant data (names, addresses, SSNs) affecting 538 individuals, including 2 NH residents. Ailco learned of the incident on February 11, 2026. Notifications were mailed on March 26, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 6 weeks / 43 days

Jan 13, 2026

Begins

Feb 11, 2026

Discovered

Mar 26, 2026

Filed

vs. sector median

2 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_3ec35e151f8c57bb2026-03-26Verified
Massachusetts State AGbd_70724aca0d2bacaa2026-03-26Candidate
Indiana State AGbd_9bf329650e4d359d2026-03-26Candidate

Name: AILCO
norm: ailco
Domain: ailco.com

Name: AILCO
norm: ailco
Domain: ailco.com
Industry: Financial Servicesllm

Discovered: Feb 11, 2026
Breach occurred: Jan 13, 2026
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2026
Affected individuals: 538state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via Kaaj Technologies Inc.
Initial access: supply_chain

During the incident: Coordinated with Kaaj to determine whether its applicants’ information may have been impacted
Launched an investigation to confirm the security of our network
Provided written notice of this incident to relevant state regulators
Provided notice to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Mailed notification letters to potentially impacted individuals on or about March 26, 2026
Changes made: Implemented additional safeguards and enhanced monitoring
Updates to network and infrastructure security
Enhanced monitoring and threat detection
Enhanced access control and authentication
Enhanced application security
Offering 12 months of credit monitoring and identity protection services through Experian IdentityWorks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGMar 26 · first

Massachusetts State AGMar 26 · first

Indiana State AGMar 26 · first

New Hampshire State AGMar 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ailco-equipment-finance-group-20260326.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2026
Raw hash: 498bc86e240857c56890890521962976de3b64a76ae7961a3dfa91e8bc88700b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAILCO

Victim entityAILCO

Incidentdiscovered Feb 11, 2026

Stated responseCoordinated with Kaaj to determine whether its applicants’ information may have been impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov