HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

King Ocean Services

bd_76e40af66aed8933 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2025

Filed

Jul 13, 2026

To disclose

29 weeks

Affected

5state residents only

Linked

4 filings

Confidence

66%

Full breach record for King Ocean Services →

King Ocean Services Limited notified the NH Attorney General of a data breach affecting approximately 5 New Hampshire residents. On August 12, 2025, an unauthorized third party remotely accessed and acquired data from King Ocean servers via a compromise of its third-party IT service provider. The incident was discovered on December 22, 2025. Affected data may include names, driver's license or state ID numbers, dates of birth, or passport numbers. King Ocean engaged cybersecurity experts, cooperated with the FBI and Secret Service, and terminated unauthorized access. Notices were sent to affected residents on July 10, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 132 days

discovery → filing · 29 weeks / 203 days

Aug 12, 2025

Begins

Dec 22, 2025

Discovered

Jul 13, 2026

Filed

vs. sector median

+10 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

South Carolina State AGbd_2f005002e8e02d3b2026-07-13Candidate
Vermont State AGbd_1afc0b48bb9fadc32026-07-11 · +2dVerified
Massachusetts State AGbd_e131f435c1d7aa6d2026-07-11 · +2dVerified

Name: King Ocean Services Limited
norm: king ocean services
Domain: carltonfields.com

Name: King Ocean Services
norm: king ocean
Domain: kingocean.com
Industry: Professional Servicesllm

Discovered: Dec 22, 2025
Breach occurred: Aug 12, 2025
Undetected for: 132 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2026
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralCooperated with the Federal Bureau of InvestigationCooperated with the U.S. Secret Service
Third party: via third-party information technology (IT) service provider
Initial access: supply_chain

During the incident: Engaged third-party cybersecurity experts to remediate, further investigate, and determine the scope of the incident
Worked with third-party data review specialists to perform a comprehensive programmatic and manual review of the potentially affected data
Reported the incident to, and cooperated with, the Federal Bureau of Investigation and the U.S. Secret Service
Terminated the unauthorized access
Assessed the security of its systems
Sent written notice of the incident to affected residents
Changes made: Took actions to prevent a similar incident from occurring in the future, including security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(203 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGJul 11 · first

Massachusetts State AGJul 11 · first

South Carolina State AG+2d

New Hampshire State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/king-ocean-services-20260713.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 13, 2026
Raw hash: a3ce3405e235dbea1cc1c582d12960ca43d09b4471aadd1925831a80dec9623c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKing Ocean Services Limited

Victim entityKing Ocean Services

Incidentdiscovered Dec 22, 2025

Stated responseEngaged third-party cybersecurity experts to remediate, further investigate, and determine the scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov