UnknownFinancial ServicesFinanceCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPIIMediumContained

D.B. Root & Company, LLC

bd_8fd56526a643b8db · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 9, 2026

Filed

Jun 2, 2026

To disclose

8 weeks

Affected

22state residents only

Linked

4 filings

Confidence

63%

Full breach record for D.B. Root & Company, LLC →

D.B. Root & Company, LLC notified Massachusetts residents of a data security incident occurring November 11-12, 2025. The company determined that personal information, including names and other data elements, may have been subject to unauthorized acquisition. No evidence of financial fraud or identity theft was found. The company engaged Kroll to provide complimentary identity monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock⏱ MA AG >30d8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 149 days

discovery → filing · 8 weeks / 54 days

Nov 11, 2025

Begins

Apr 9, 2026

Discovered

Jun 2, 2026

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_333589d658620d442026-06-02Verified
Vermont State AGbd_6622132d74f4fbbd2026-06-02Verified
New Hampshire State AGbd_fad684ab923659fe2026-06-08 · +6dVerified

Name: D.B. Root & Company, LLC
norm: db root

Name: D.B. Root & Company, LLC
norm: db root
Industry: Financial Servicesllm

Discovered: Apr 9, 2026
Breach occurred: Nov 11, 2025 – Nov 12, 2025
Undetected for: 149 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 22state-resident count only
Data types: Financial accountIdentity (basic)Government IDPII
Attack vector: Unknown
Threat actor: External

During the incident: Secured our network
Engaged external cybersecurity professionals
Engaged Kroll to provide identity monitoring
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluate and modify practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: MA AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 2 · first

Vermont State AGJun 2 · first

Massachusetts State AGJun 2 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jun 2 (ME), last Jun 8 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-899-db-root-company-llc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2026
Raw hash: 8e5efc4a3d312713e6a3080ab81b8b759ba3a4061d84ddaabcbc8e05a85cab42

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityD.B. Root & Company, LLC

Victim entityD.B. Root & Company, LLC

Incidentdiscovered Apr 9, 2026

Stated responseSecured our network

ComplianceMA AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov