MalwareRetail & ConsumerRetailSkimmerCustomer Data InvolvedFinancial accountFinancial credentialsIdentity (basic)LowContained

Harbor Fish Market

bd_8cc7ea6d39989a10 · schema v1 · pii pii-v2

Severity

Low

Discovered

Jul 26, 2026

Filed

Sep 25, 2026

To disclose

9 weeks

Affected · nationwide

75013 in this filing

Linked

3 filings

Confidence

68%

Full breach record for Harbor Fish Market →

Harbor Fish Market, a retail seafood market in Portland, Maine, discovered malicious skimming code on its website on July 26, 2026. The code was active between February 7 and July 26, 2026, potentially capturing payment card data (number, expiration, CVV) and personal information (name, address, email, phone) of approximately 750 customers. 13 New Hampshire residents were affected. The company deactivated the code, engaged cybersecurity experts, and is offering 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 169 days

discovery → filing · 9 weeks / 61 days

Feb 7, 2026

Begins

Jul 26, 2026

Discovered

Sep 25, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_8dee54d6225c7d142026-09-25Verified
Massachusetts State AGbd_532df406183907d92026-09-01 · +24dCandidate

Name: Harbor Fish Market
norm: harbor fish market

Name: Harbor Fish Market
norm: harbor fish market
Domain: harborfishmarket.com
Industry: Retail & Consumerllm

Discovered: Jul 26, 2026
Breach occurred: Feb 7, 2026 – Jul 26, 2026
Undetected for: 169 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2026
Affected individuals: 750state + nationwide
Data types: Financial accountFinancial credentialsIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1528.002 Web ShellT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice Office of the Attorney General
Initial access: exploit_public_facing

During the incident: Deactivated the malicious code
Engaged a reputable cybersecurity expert to conduct a detailed assessment
Conducted a thorough review of the website to ensure that the identified compromise has been remediated
Notifying all potentially affected customers who placed orders on the website while the malicious code was active
Changes made: Implemented additional safeguards and monitoring measures designed to detect and prevent similar activity in the future
Offering affected customers complimentary membership in 12 months' identity theft protection services through Epiq's Privacy Solutions ID product
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGSep 1 · first

Indiana State AG+24d

New Hampshire State AG+24d · this page

Pattern: first filing Sep 1 (MA), last Sep 25 (NH) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/harbor-fish-market-20260925.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2026
Raw hash: b32e42bb85d3abd6c148f054af1256ae35934190093db0cc8834c04475a40897

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHarbor Fish Market

Victim entityHarbor Fish Market

Incidentdiscovered Jul 26, 2026

Stated responseDeactivated the malicious code

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov