HackingOtherCustomer Data InvolvedGovernment IDIdentity (basic)Health (basic)MediumContained

Rochester Philharmonic Orchestra

bd_87299a39b808c71e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 11, 2025

Filed

May 29, 2026

To disclose

28 weeks

Affected

2state residents only

Linked

9 filings

Confidence

66%

Full breach record for Rochester Philharmonic Orchestra →

Rochester Philharmonic Orchestra (RPO) notified the New Hampshire Attorney General of a data security incident affecting 2 New Hampshire residents. Unauthorized access occurred on October 21, 2025, when servers went offline. RPO engaged cybersecurity experts and determined on November 11, 2025, that specific network sections were accessed. Personal information, including names, SSNs, driver's licenses, health insurance, medical info, and passport numbers, may have been compromised. No evidence of misuse was found. RPO notified residents on May 27, 2026, and offered 12 months of credit monitoring and identity protection services through IDX.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 21 days

discovery → filing · 28 weeks / 199 days

Oct 21, 2025

Begins

Nov 11, 2025

Discovered

May 29, 2026

Filed

vs. sector median

+20 wks slower

This filing is one of 9 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 226 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_a657d39e33120bb92025-11-25 · +185dVerified by operator
Leak Siteakirabd_3e1555b835a5290a2025-10-15 · +226dVerified by operator

Regulatory filings (6) · sorted by filing gap

Vermont State AGbd_b02eb26d4824fec92026-05-29Verified by operator
Massachusetts State AGbd_253bda8c448c14ad2026-05-28 · +1dVerified by operator
Maine State AGbd_c1c85951f3e733f22026-05-28 · +1dVerified by operator
Indiana State AGbd_74744a5301dae8922026-05-27 · +2dVerified by operator

Show 2 more filings ↓up to 226d gap

Nebraska State AGbd_87fc6915934ecfc82026-05-27 · +2dVerified by operator
Pressakirabd_d4a7f57346bbcdb02025-10-15 · +226dCandidate

Name: Rochester Philharmonic Orchestra
norm: rochester philharmonic orchestra
Domain: rpo.org

Name: Rochester Philharmonic Orchestra
norm: rochester philharmonic orchestra
Domain: rpo.org
Industry: Otherllm

Discovered: Nov 11, 2025
Breach occurred: Oct 21, 2025
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 27, 2026
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Engaged independent cybersecurity experts
Launched a forensics investigation
Implemented additional security measures
Notifying the affected individuals
Offering affected individuals complimentary credit monitoring and identity protection services through IDX
Changes made: Implemented additional security measures to further harden its environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(199 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

PressOct 15 · first

Indiana State AG+224d

Nebraska State AG+224d

Massachusetts State AG+225d

Maine State AG+225d

Vermont State AG+226d

New Hampshire State AG+226d · this page

Pattern: first filing Oct 15, last May 29 (NH) — a 226-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rochester-philharmonic-orchestra-20260529.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: 2f11697949bd91fd1290faf1d9bf3e2ddfb130b56528b762d172c582c61e2acd

Linked disclosures

Ransomware claims (2)

Regulatory filings (6) · sorted by filing gap

Reporting entityRochester Philharmonic Orchestra

Victim entityRochester Philharmonic Orchestra

Incidentdiscovered Nov 11, 2025

Stated responseEngaged independent cybersecurity experts

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov