HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

Memberclose LLC

bd_80c826d6a50e264f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 30, 2025

Filed

Jan 20, 2026

To disclose

12 weeks

Affected

130state residents only

Linked

6 filings

Confidence

66%

Full breach record for Memberclose LLC →2 incidents on file

Memberclose, LLC notified the New Hampshire Attorney General of a cybersecurity incident affecting 130 NH residents. Unauthorized access to a cloud application occurred around October 29, 2025, detected on October 30, 2025. Personal information including names, SSNs, and DOBs was exfiltrated. Memberclose engaged forensic investigators, secured the application, and provided 24 months of Kroll identity monitoring to affected individuals. Notifications were sent to residents on January 15, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 12 weeks / 82 days

Oct 29, 2025

Begins

Oct 30, 2025

Discovered

Jan 20, 2026

Filed

vs. sector median

+3 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_6341163658c0edea2026-01-16 · +4dVerified
Maine State AGbd_152b61b1bbabe4ef2026-01-15 · +5dCandidate
Nebraska State AGbd_6262ef1e5d9649752026-01-15 · +5dVerified
Vermont State AGbd_67e63e1fc12946ce2026-01-15 · +5dVerified

Show 1 more filing ↓up to 5d gap

Indiana State AGbd_83cd25f40fe6fedb2026-01-15 · +5dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Memberclose LLC
norm: memberclose
Industry: Financial ServicesllmTechnologyllm

Discovered: Oct 30, 2025
Breach occurred: Oct 29, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2026
Affected individuals: 130state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General, Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Commenced an immediate and thorough investigation
Worked to identify what personal information, if any, might have been present in the accessed systems
Following a forensics investigation and complex manual document review
Notified the Data Owners on or around December 15, 2025
Took steps to secure the application
Commenced a prompt and thorough investigation with external cybersecurity professionals
Provided identity monitoring at no cost to you for 24 months
Set up a dedicated and confidential toll-free response line
Changes made: Memberclose continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Memberclose continually evaluate and modify our practices and internal controls to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGJan 15 · first

Nebraska State AGJan 15 · first

Vermont State AGJan 15 · first

Indiana State AGJan 15 · first

Massachusetts State AG+1d

New Hampshire State AG+5d · this page

Pattern: first filing Jan 15 (ME), last Jan 20 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/memberclose-20260120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2026
Raw hash: 898c8f9a23a9654362353014c8f0f644f773aa2c4fa5b6dbe4da3030be52857e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityMemberclose LLC

Incidentdiscovered Oct 30, 2025

Stated responseCommenced an immediate and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov