HackingRetail & ConsumerRetailData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Mister Guns

bd_8603fb9c5608cd4a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 14, 2025

Filed

Apr 6, 2026

To disclose

20 weeks

Affected

7state residents only

Linked

7 records

Confidence

66%

Full breach record for Mister Guns →

Mister Guns notified the NH Attorney General of unauthorized access to its network on November 14, 2025. An investigation determined that files removed by an unauthorized third-party contained personal information (full name and driver's license number) of approximately seven New Hampshire residents. The company contained the threat, engaged external cybersecurity professionals, and is offering credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d20 weeks discovery → filing

Incident timeline

discovery → filing · 20 weeks / 143 days

Nov 14, 2025

Begins

Nov 14, 2025

Discovered

Apr 6, 2026

Filed

vs. sector median

+11 wks slower

This filing is one of 7 records about the same incident.View merged incident

A leak claim by securotrop about this victim was first seen 135 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesecurotropbd_4764204dd81c8d492025-11-21 · +136dVerified by operator

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_8ffd4b1c42ca7b812026-04-01 · +5dVerified
Massachusetts State AGbd_f47fe85a2f423a5d2026-04-01 · +5dVerified by operator
Indiana State AGbd_3bac2bcb569f3ccd2026-03-31 · +6dVerified
Texas State AGbd_18e9186e4888d2ea2026-03-25 · +12dCandidate

Show 1 more filing ↓up to 57d gap

Texas State AGbd_add46516093b4ca82026-06-02 · +57dVerified

Name: Mister Guns
norm: mister guns
Domain: misterguns.com

Name: Mister Guns
norm: mister guns
Domain: misterguns.com
Industry: Retail & Consumerllm

Discovered: Nov 14, 2025
Breach occurred: Nov 14, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 31, 2026
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified Office of the Attorney General, Consumer Protection Bureau, New Hampshire

During the incident: Contained the threat
Commenced a prompt and thorough investigation
Engaged external cybersecurity professionals
Provided written notification of this incident commencing on or about March 31, 2026
Offering the affected residents whose Social Security numbers were impacted complimentary memberships with a credit monitoring service
Advising the affected residents about the process of placing fraud alerts and/or security freezes on their credit files and obtaining free credit reports
Changes made: Continually evaluate and modify its practices to enhance the security and privacy of the information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Texas State AGMar 25 · first

Indiana State AG+6d

Maine State AG+7d

Massachusetts State AG+7d

New Hampshire State AG+12d · this page

Texas State AG+69d

Pattern: first filing Mar 25 (TX), last Jun 2 (TX) — a 69-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mister-guns-20260406.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2026
Raw hash: 94ba59be922bb7b8a022abfef9f52754a83759eb82e9d836992da99496d752fd

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityMister Guns

Victim entityMister Guns

Incidentdiscovered Nov 14, 2025

Stated responseContained the threat

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov