Social EngineeringProfessional ServicesProfessional ServicesPhishingTargetedCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

BLOOMSBURY PUBLISHING INC.

bd_9943c0fb19786cbe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 15, 2026

Filed

May 11, 2026

To disclose

26 days

Affected

4state residents only

Linked

2 filings

Confidence

66%

Full breach record for BLOOMSBURY PUBLISHING INC. →

Bloomsbury Publishing, Inc. reported a data event to the New Hampshire Attorney General on May 11, 2026. An unknown individual impersonated a company executive on April 2, 2026, to obtain employees' 2025 Form W-2s containing names and Social Security numbers. Bloomsbury discovered the incident on April 15, 2026, and notified approximately four New Hampshire residents. Response actions included notifying law enforcement, sending written notices, and providing two years of complimentary credit monitoring through IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 26 days

Apr 2, 2026

Begins

Apr 15, 2026

Discovered

May 11, 2026

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_211166df1ff8ff982026-05-11Candidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: BLOOMSBURY PUBLISHING INC.
norm: bloomsbury publishing
Industry: Professional Servicesllm

Discovered: Apr 15, 2026
Breach occurred: Apr 2, 2026
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2026
Affected individuals: 4state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement regarding the event
Initial access: phishing_link

During the incident: Notified federal law enforcement regarding the event
Notified employees by email within 24 hours
Sent employees notices via written letter
Providing access to credit monitoring services for two (2) years, through IDX, to notified individuals, at no cost
Changes made: Implementing additional safeguards and training to its employees
Increasing the aggressiveness of its email spam filtering
Increasing social engineering and phishing training frequency
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 11 · first

New Hampshire State AGMay 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bloomsbury-publishing-20260511.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2026
Raw hash: 9fbdb6b54a07ed97286980069ec4d821870b264a5e9fcdcfde253bd72557afc7

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityBLOOMSBURY PUBLISHING INC.

Incidentdiscovered Apr 15, 2026

Stated responseNotified federal law enforcement regarding the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov