HackingVulnerability ExploitCapture Stored DataData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIALMediumContained
TKH Group
bd_90a7be27efc13043 · schema v1 · pii pii-v1
Full breach record for TKH Group →TKH Group, PC notified Vermont AG of a September 21, 2025 unauthorized network access incident exposing client PII, SSNs, and financial data. TKH engaged forensic investigators, notified authorities, and offered credit monitoring. No identity theft reported. Count undisclosed.
Vermont clock✗ VT AG >45 bday17 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_4a5c35a791666f7cIndiana State AGfiled 2026-01-15Candidate
- bd_88b1ef0238001f25Indiana State AGfiled 2026-01-15Candidate
- bd_f93f58455746d3c3New Hampshire State AGfiled 2026-01-15Verified
- bd_fbe015afff29d7b6Maine State AGfiled 2026-01-15Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2026-01-15-tkh-group-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 15, 2026
- Raw hash
- cfae684b01d4e3d3d622a6b5f19fa8dc302b2f950b139e5142f7bf0429b8de1a
Reporting entity
- Name
- TKH Groupnorm: tkh group
Victim entity
- Name
- TKH Groupnorm: tkh group
Incident
- Discovered
- Sep 21, 2025
- Materiality determined
- —
- Notification sent
- Jan 15, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTFINANCIAL
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
- Threat actor
- External
- Regulator citations
- reported the incident to state and federal authorities
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 17 weeks(116 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.