DisclosureLens
Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Deloitte

bd_88bc0706d808c993 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 18, 2026

Filed

Apr 2, 2026

To disclose

6 weeks

Affected

1state residents only

Confidence

66%
Full breach record for Deloitte4 incidents on file

Deloitte Services LP notified the New Hampshire Attorney General on April 2, 2026, of a social engineering incident affecting one NH resident. On February 13, 2026, an unauthorized actor impersonated an employee via phone to reset credentials and access the employee's personnel account, exposing the employee's name and Social Security number. Deloitte discovered the incident on February 18, 2026, reset credentials, and implemented process changes. The company offered one year of Experian IdentityWorks to the affected individual.

Incident timeline

undetected · 5 days
discovery → filing · 6 weeks / 43 days

Feb 13, 2026

Begins

Feb 18, 2026

Discovered

Apr 2, 2026

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.