UnknownGovernmentGovernmentDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Government IDMediumActive

Town of Amherst, NY

bd_96efd768e3feeef1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 3, 2026

Filed

Apr 6, 2026

To disclose

9 weeks

Affected

260state residents only

Linked

3 filings

Confidence

67%

Full breach record for Town of Amherst, NY →4 incidents on file

Town of Amherst, NH, notified the NH Attorney General on April 6, 2026, of a potential security incident affecting approximately 260 residents. On or about February 3, 2026, employees experienced issues with tax filings. The Town secured its network and engaged cybersecurity experts. No evidence of system compromise was found, but W-2 forms (names, SSNs) may have been impacted. Notifications were sent on April 1, 2026, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 62 days

Feb 3, 2026

Discovered

Apr 6, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_1d229ff524b8cfad2026-04-01 · +5dVerified
Maine State AGbd_27246d6f83f899e62026-04-01 · +5dCandidate

Name: Town of Amherst, NY
norm: town of amherst ny

Name: Town of Amherst, NY
norm: town of amherst ny
Industry: Governmentllm

Discovered: Feb 3, 2026
Materiality determined: —
Notification sent: Apr 1, 2026
Affected individuals: 260state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau

During the incident: Secured our network
Engaged leading cybersecurity experts to identify what personal information, if any, was involved
Provided the affected residents with notification of this incident
Provided contact information for the consumer reporting agencies and the Federal Trade Commission
Provided a complimentary one-year membership with a credit monitoring service upon request
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 1 · first

Maine State AGApr 1 · first

New Hampshire State AG+5d · this page

Pattern: first filing Apr 1 (MA), last Apr 6 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/town-amherst-20260406.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2026
Raw hash: 12813a8894822b44373238c93f4fce6cd4e4a09fd37aa1f141023850a5274e0b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityTown of Amherst, NY

Victim entityTown of Amherst, NY

Incidentdiscovered Feb 3, 2026

Stated responseSecured our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov