HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

HENNESSY ADVISORS, INC.

bd_6d4e4e25f72021c3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 30, 2025

Filed

Feb 24, 2026

To disclose

47 weeks

Affected

95state residents only

Linked

9 filings

Confidence

67%

Full breach record for HENNESSY ADVISORS, INC. →

Hennessy Advisors, Inc. notified the New Hampshire Attorney General of a security incident discovered on March 30, 2025. Unauthorized access to systems resulted in the exfiltration of personal information for 95 New Hampshire residents, including names, SSNs, driver's license numbers, and financial account data. The breach was confirmed in December 2025, and notifications were sent to affected individuals on February 23, 2026, offering credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 47 weeks / 331 days

Mar 30, 2025

Discovered

Feb 24, 2026

Filed

vs. sector median

+39 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

California State AGbd_072c9ab8534cfc812026-02-24Verified
Maine State AGbd_41991ab4574f8c982026-02-24Verified by operator
Massachusetts State AGbd_4cad2bf43441a73a2026-02-24Verified
Texas State AGbd_4a3d6923a18d23b52026-02-25 · +1dVerified by operator

Show 4 more filings ↓up to 23d gap

Indiana State AGbd_155d62cf979564682026-02-23 · +1dCandidate
Vermont State AGbd_d11bdc84764407482026-02-23 · +1dVerified
Nebraska State AGbd_f68cb883eed2da892026-02-23 · +1dVerified
Illinois State AGbd_ffe201debd927b8a2026-02-01 · +23dVerified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: HENNESSY ADVISORS, INC.
norm: hennessy advisors
Domain: hennessyadvisors.com
Industry: Financial Servicesllm

Discovered: Mar 30, 2025
Materiality determined: —
Notification sent: Feb 23, 2026
Affected individuals: 95state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Retained third-party specialists to determine what happened and to secure systems and data
Established a toll-free call center through IDX to answer questions about the incident
Notified potentially affected individuals via USPS First-Class Mail
Offered complimentary identity protection services including 12 months of credit monitoring
Changes made: Secured systems and data
Continued to monitor the situation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(331 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Illinois State AGFeb 1 · first

Indiana State AG+22d

Vermont State AG+22d

Nebraska State AG+22d

California State AG+23d

Maine State AG+23d

Massachusetts State AG+23d

New Hampshire State AG+23d · this page

Texas State AG+24d

Pattern: first filing Feb 1 (IL), last Feb 25 (TX) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/hennessy-advisors-20260224.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2026
Raw hash: ae4a5fec1e8d7b54cdfb763fcb459139be11f3b7d9aeffe2ae7c164a29c5cabf

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityHENNESSY ADVISORS, INC.

Incidentdiscovered Mar 30, 2025

Stated responseRetained third-party specialists to determine what happened and to secure systems and data

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov