HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPIIMediumContained

H&H Color Lab

bd_97c30413c8933661 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 31, 2025

Filed

Jan 14, 2026

To disclose

24 weeks

Affected

5state residents only

Linked

4 filings

Confidence

62%

Full breach record for H&H Color Lab →

H&H Color Lab detected suspicious activity on July 31, 2025. Investigation revealed an unauthorized third party accessed their network on the night of July 30, 2025, and accessed or acquired some files. The company engaged third-party cybersecurity experts, notified law enforcement, and offered identity theft protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d24 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 24 weeks / 167 days

Jul 30, 2025

Begins

Jul 31, 2025

Discovered

Jan 14, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_390908f440605a152026-01-13 · +1dCandidate
Maine State AGbd_62c63dc3b1e2c28d2026-01-13 · +1dVerified
Nebraska State AGbd_7dfb4322c4d2c1e92026-01-13 · +1dVerified

Name: H&H Color Lab
norm: h h color lab

Name: H&H Color Lab
norm: h h color lab
Industry: Professional Servicesllm

Discovered: Jul 31, 2025
Breach occurred: Jul 30, 2025 – Jul 30, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: Financial accountIdentity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Worked with third-party cybersecurity experts to investigate and remediate
Notified law enforcement
Offered complimentary Experian IdentityWorks membership
Changes made: Further secured our systems to protect your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGJan 13 · first

Maine State AGJan 13 · first

Nebraska State AGJan 13 · first

Massachusetts State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-57-hh-color-lab-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2026
Raw hash: 8aaa8756dd5737a8d0bab6dfef40bb20e942fdaf206a80b451555a358096b57d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityH&H Color Lab

Victim entityH&H Color Lab

Incidentdiscovered Jul 31, 2025

Stated responseWorked with third-party cybersecurity experts to investigate and remediate

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov