DisclosureLens
HackingRetail & ConsumerRetailVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

EMC Water LLC

bd_711f227ea96c99b8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2025

Filed

Jan 26, 2026

To disclose

12 weeks

Affected

112state residents only

Linked

6 filings

Confidence

66%
Full breach record for EMC Water LLC

EMC Water, LLC notified the New Hampshire Attorney General of a security incident involving Oracle E-Business Suite. An external actor exploited a previously unknown vulnerability (zero-day) in Oracle EBS to exfiltrate data between August 9 and 18, 2025. EMC Water learned of the incident in late November 2025. The breach affected 112 New Hampshire residents, exposing names and Social Security numbers. Notification letters were mailed on January 26, 2026, offering one year of credit monitoring. EMC Water applied the relevant Oracle patch and engaged third-party cybersecurity professionals and law enforcement.

Incident timeline

undetected · 84 days
discovery → filing · 12 weeks / 86 days

Aug 9, 2025

Begins

Nov 1, 2025

Discovered

Jan 26, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Show 1 more filing

Filing propagation · 6 filings · 6 states

View merged incident ↗
Massachusetts State AGJan 26 · first
Indiana State AGJan 26 · first
Maine State AGJan 26 · first
Vermont State AGJan 26 · first
Nebraska State AGJan 26 · first
New Hampshire State AGJan 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.