HackingSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Velocity Risk Underwriters
bd_925ef2c1c3de1907 · schema v1 · pii pii-v1
Full breach record for Velocity Risk Underwriters →Velocity Risk Underwriters, LLC notified the NH AG of a third-party data breach involving its prior vendor, WaterStreet Company. Unauthorized access occurred on March 17, 2025, impacting New Hampshire residents' names, financial account info, and SSNs. Velocity is offering 12 months of credit monitoring.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_3228d13e1b7bb975Texas State AGfiled 2025-07-28(4d gap)Verified by operator
- bd_640c7bbdabca27ccIndiana State AGfiled 2025-08-08(15d gap)Verified
- bd_2fcba4315454f903New Hampshire State AGfiled 2025-09-04(42d gap)Verified
- bd_cf1decc7cfc0f317Maine State AGfiled 2025-09-04(42d gap)Verified by operator
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/velocity-risk-underwriters-waterstreet-20250724.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 24, 2025
- Raw hash
- 3fac7269758879403c204ba7da35cf54d3ada40a2bb6b6d9868fa2214e7d37d1
Reporting entity
- Name
- Velocity Risk Underwritersnorm: velocity risk underwriters
Victim entity
- Name
- Velocity Risk Underwritersnorm: velocity risk underwriters
Incident
- Discovered
- Mar 17, 2025
- Materiality determined
- Jun 26, 2025
- Notification sent
- —
- Affected individuals
- 37
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified New Hampshire Attorney General Consumer Protection Bureau
- Third party
- via WaterStreet Company
- Initial access
- supply_chain
Compliance
- Time to disclose
- 18 weeks(129 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.