HackingStolen CredentialsCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Amalgamated Sugar
bd_959f87de997d477b · schema v1 · pii pii-v1
Full breach record for Amalgamated Sugar →Amalgamated Sugar Company reported a data security incident to the New Hampshire Attorney General on May 28, 2025. The company became aware of unusual network activity on February 5, 2025, which led to the unauthorized acquisition of personal information belonging to employees, dependents, and shareholders. One New Hampshire resident was notified. The company engaged cybersecurity experts and offered complimentary identity protection services through TransUnion.
Leak gap clock⏱ Leak >90d16 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
A leak claim by cactus about this victim predates this filing by 111 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_2ead70b3f08f00e2Montana State AGfiled 2025-05-28Candidate
- bd_dea31467b80e673fVermont State AGfiled 2025-05-28Verified
- bd_eb639ac158fcfe44Oregon State AGfiled 2025-05-28Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/amalgamated-sugar-20250528.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 28, 2025
- Raw hash
- 913e9f18fec295e061c8a10a8eb7bea7a15967bc7139c3525b46562dcf4bf03e
Reporting entity
- Name
- Amalgamated Sugarnorm: amalgamated sugar
- Domain
- amalgamatedsugar.com
Victim entity
- Name
- Amalgamated Sugarnorm: amalgamated sugar
- Domain
- amalgamatedsugar.com
Incident
- Discovered
- Feb 5, 2025
- Materiality determined
- —
- Notification sent
- May 28, 2025
- Affected individuals
- 1
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified Attorney General John Formella
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 16 weeks(112 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.