MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Chemical & Industrial Engineering Inc.

bd_6e9c261ccfd4f82a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 10, 2025

Filed

Apr 13, 2026

To disclose

35 weeks

Affected

1state residents only

Linked

6 filings

Confidence

64%

Full breach record for Chemical & Industrial Engineering Inc. →

Chemical and Industrial Engineering, Inc. notified the New Hampshire Attorney General of a ransomware incident affecting one New Hampshire resident. Unauthorized access occurred between June and August 2025, detected on August 10, 2025. Impacted data included names, government IDs (SSN), financial account numbers, and limited medical information. Notices were mailed on April 7, 2026, offering credit monitoring. The company engaged forensic experts and implemented security enhancements including MFA and firewall upgrades.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 70 days

discovery → filing · 35 weeks / 246 days

Jun 1, 2025

Begins

Aug 10, 2025

Discovered

Apr 13, 2026

Filed

vs. sector median

+17 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_11fbd9e5c4581e952026-04-16 · +3dVerified
Indiana State AGbd_4d1115d2f4337bb82026-04-07 · +6dVerified by operator
Nebraska State AGbd_7d7f738389f5518b2026-04-07 · +6dVerified
Vermont State AGbd_340152f4cfb586d82026-04-05 · +8dVerified

Show 1 more filing ↓up to 8d gap

Maine State AGbd_a99dfdb5ee1674b32026-04-05 · +8dCandidate

Name: Chemical & Industrial Engineering Inc.
norm: chemical industrial engineering
Domain: cieng.com

Name: Chemical & Industrial Engineering Inc.
norm: chemical industrial engineering
Domain: cieng.com
Industry: Professional Servicesllm

Discovered: Aug 10, 2025
Breach occurred: Jun 1, 2025 – Aug 31, 2025
Undetected for: 70 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Engaged outside counsel
Retained cybersecurity experts to conduct a forensic investigation
Engaged a data-review firm
Notified law enforcement
Mailed written notices to affected individuals
Changes made: Expanded the use of multifactor authentication
Adopted new password policies
Removed/combined administrator accounts
Upgraded hardware
Enhanced firewalls
Removed internet facing IP addresses
Added a new vulnerability scanner
Implemented revised policies for firewalls and switches
Rebuilt entire file and server backup system
Implementing specific role and folder security using the least privilege principle
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(246 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGApr 5 · first

Maine State AGApr 5 · first

Indiana State AG+2d

Nebraska State AG+2d

New Hampshire State AG+8d · this page

Massachusetts State AG+11d

Pattern: first filing Apr 5 (VT), last Apr 16 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chemical-industrial-engineering-20260413.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 13, 2026
Raw hash: 571dab495774af2e4a8a8827aac11acc6f83acdb948be0a78cbc955a394cc2ad

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityChemical & Industrial Engineering Inc.

Victim entityChemical & Industrial Engineering Inc.

Incidentdiscovered Aug 10, 2025

Stated responseEngaged outside counsel

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov