HackingManufacturingManufacturingVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsCredentialsMediumContained

MASTEC, INC.

bd_9a55bbe733ae71cb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 1, 2025

Filed

Jun 4, 2026

To disclose

35 weeks

Affected

18state residents only

Linked

9 filings

Confidence

64%

Full breach record for MASTEC, INC. →2 incidents on file

MasTec, Inc. notified the New Hampshire Attorney General of a security event affecting 18 NH residents (and 73 RI residents) involving unauthorized access via a zero-day vulnerability in a third-party solution. The incident occurred in August 2025, was detected in October 2025, and involved the exfiltration of names, SSNs, financial account details, and credentials. MasTec applied patches, engaged forensic experts, and mailed notices on June 5, 2026, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d35 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 61 days

discovery → filing · 35 weeks / 246 days

Aug 1, 2025

Begins

Oct 1, 2025

Discovered

Jun 4, 2026

Filed

This filing is one of 9 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 215 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_077ee15e6166ed792025-10-31 · +215dVerified by operator

Regulatory filings (7) · sorted by filing gap

Vermont State AGbd_17006039c927389d2026-06-05 · +1dVerified
Indiana State AGbd_2337a1feed74d7a42026-06-05 · +1dVerified
Nebraska State AGbd_69df7fd6f827f7472026-06-05 · +1dVerified
Maine State AGbd_b14ee6c6db7a57262026-06-05 · +1dVerified

Show 3 more filings ↓up to 5d gap

South Carolina State AGbd_d93b0d10e9a7baae2026-06-05 · +1dVerified
Texas State AGbd_2db96186099527c32026-06-09 · +5dVerified
Massachusetts State AGbd_fa5d678c3d2160372026-06-09 · +5dVerified

Name: MASTEC, INC.
norm: mastec
Domain: mastec.com

Name: MASTEC, INC.
norm: mastec
Domain: mastec.com
Industry: Manufacturingllm

Discovered: Oct 1, 2025
Breach occurred: Aug 1, 2025 – Aug 31, 2025
Undetected for: 61 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 5, 2026
Affected individuals: 18state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsCredentials
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection & Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Deployed the applicable patch to address the zero-day vulnerability
Engaged outside counsel
Retained cybersecurity experts to conduct a forensic investigation
Engaged a data-review vendor to analyze the contents of those files
Notified law enforcement
Offered 12 months of complimentary credit monitoring
Changes made: Applied the patch to address the zero-day vulnerability
Continue to employ robust cybersecurity safeguards and training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(246 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

New Hampshire State AGJun 4 · first · this page

South Carolina State AG+1d

Texas State AG+5d

Massachusetts State AG+5d

Pattern: first filing Jun 4 (NH), last Jun 9 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mastec-20260604.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 4, 2026
Raw hash: 6ded25f90af4bfa5b89ce2befe77a448aef13bad0fb28da8c431f3cd954e8160

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityMASTEC, INC.

Victim entityMASTEC, INC.

Incidentdiscovered Oct 1, 2025

Stated responseDeployed the applicable patch to address the zero-day vulnerability

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov