HackingStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIDENTITY_GOVERNMENTPIIMediumContained
Bayside Distributing, LLC
bd_8a478f1ff268e976 · schema v1 · pii pii-v1
Full breach record for Bayside Distributing, LLC →Bayside Distributing, LLC reported a cybersecurity incident to the New Hampshire Attorney General on May 1, 2026. Unauthorized remote access was detected on February 16, 2026, via a third-party IT provider. While initial assessment suggested no data compromise, subsequent IRS notifications to employees regarding SSN misuse led to a re-evaluation. Approximately 100 New Hampshire employees may have been affected. The incident involved a supply-chain compromise via the IT provider's VPN credentials.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed100 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bayside-distributing-20260501.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 1, 2026
- Raw hash
- b914de18ff49f9219e3ead86628994244fc81a14602775bf9791dc12458a81ad
Reporting entity
- Name
- Bayside Distributing, LLCnorm: bayside distributing
Victim entity
- Name
- Bayside Distributing, LLCnorm: bayside distributing
Incident
- Discovered
- Feb 16, 2026
- Materiality determined
- —
- Notification sent
- May 1, 2026
- Affected individuals
- 100
- Data types
- IDENTITY_GOVERNMENTPII
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
- Third party
- via IT management services provider
- Initial access
- external_remote_services
Compliance
- Time to disclose
- 11 weeks(74 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.