MalwareRetail & ConsumerRetailRansomwareData EncryptedData ExfiltratedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Sunsweet Growers Inc.

bd_969a0a6ddd50a0e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 11, 2024

Filed

Sep 3, 2025

To disclose

38 weeks

Affected

1state residents only

Linked

5 records

Confidence

67%

Full breach record for Sunsweet Growers Inc. →

Sunsweet Growers Inc. notified the New Hampshire Attorney General of a cybersecurity incident affecting one NH resident. On December 11, 2024, systems were found inaccessible and encrypted. An unknown actor gained access and potentially copied files. Data types included names, SSNs, DOBs, and medical/health insurance info. Notification to the NH resident occurred on September 3, 2025. Response included forensic investigation, law enforcement notification, and 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d38 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 38 weeks / 266 days

Dec 11, 2024

Discovered

Sep 3, 2025

Filed

vs. sector median

+28 wks slower

This filing is one of 5 records about the same incident.View merged incident

A leak claim by ransomhub about this victim was first seen 182 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteransomhubbd_85e8ad707f2acd062025-03-04 · +182dVerified by operator

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_4d9fc4eba36b1ace2025-09-03Verified by operator
California State AGbd_7d7be0daf4118e482025-09-03Verified by operator
California State AGbd_6e1f9e832173155f2025-04-30 · +126dVerified by operator

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Sunsweet Growers Inc.
norm: sunsweet growers
Domain: sunsweet.com
Industry: Retail & Consumerllm

Discovered: Dec 11, 2024
Materiality determined: —
Notification sent: Apr 30, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched an investigation with the assistance of third-party computer specialists
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for 24 months, through CyberScout, a TransUnion company, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Changes made: Implemented additional network security measures and safeguards to further enhance our existing measures
Reviewing our existing policies and procedures regarding cybersecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(266 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

California State AGApr 30 · first

Indiana State AG+126d

California State AG+126d

New Hampshire State AG+126d · this page

Pattern: first filing Apr 30 (CA), last Sep 3 (NH) — a 126-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sunsweet-growers-20250903.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 3, 2025
Raw hash: d71e586e854d320f775d443089e8fe66571b37ff08873cfabd7dacafdfde57c2

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entitySunsweet Growers Inc.

Incidentdiscovered Dec 11, 2024

Stated responseLaunched an investigation with the assistance of third-party computer specialists

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov