Social EngineeringOtherPhishingData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

CHP 11-99 Foundation

bd_8968a5af3b4076c4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 24, 2025

Filed

Jan 20, 2026

To disclose

17 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for CHP 11-99 Foundation →2 incidents on file

CHP 11-99 Foundation notified the New Hampshire Attorney General of a data incident affecting one NH resident. A staff member clicked a phishing link on September 16, 2025, after a third-party help desk incorrectly cleared it. The attacker accessed the staff member's email, exposing membership applications, payment forms (bank/credit card info), names, addresses, and SSNs. The foundation is working with incident response vendors, implemented MFA, changed passwords, and plans to change its IT provider. Notification to the resident was scheduled for January 30, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 8 days

discovery → filing · 17 weeks / 118 days

Sep 16, 2025

Begins

Sep 24, 2025

Discovered

Jan 20, 2026

Filed

vs. sector median

+9 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_abf1655a014ba0332026-01-23 · +3dCandidate
Massachusetts State AGbd_b56890b11d4ca9ba2026-02-03 · +14dCandidate

Name: CHP 11-99 Foundation
norm: chp 11 99

Name: CHP 11-99 Foundation
norm: chp 11 99
Industry: Otherllm

Discovered: Sep 24, 2025
Breach occurred: Sep 16, 2025
Undetected for: 8 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 30, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Conducted an investigation to determine what information may have been exposed
Taken measures to increase its security
Actively working with our retained incident response vendor to better understand the situation and the scope of the compromise
Worked with our vendors to identify the attack vector and hardened security with multifactor authentication, changed passwords, and a review of security protocols
Changes made: Changed passwords
Review of security protocols
Plan to change our IT and security service provider
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGJan 20 · first · this page

California State AG+3d

Massachusetts State AG+14d

Pattern: first filing Jan 20 (NH), last Feb 3 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chp-11-foundation-20260120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2026
Raw hash: c272107ffc9394081cff2485ed4da03581f9d88478e844d1b910a505d1a5aa4c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCHP 11-99 Foundation

Victim entityCHP 11-99 Foundation

Incidentdiscovered Sep 24, 2025

Stated responseConducted an investigation to determine what information may have been exposed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov