HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Goodwin Partners, LLP

bd_9ca62fdcb510027d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 23, 2025

Filed

Jan 20, 2026

To disclose

28 days

Affected

8state residents only

Linked

3 filings

Confidence

66%

Full breach record for Goodwin Partners, LLP →3 incidents on file

Goodwin Partners, LLP notified the New Hampshire Attorney General of a cybersecurity incident affecting approximately 8 state residents. Unauthorized access occurred between August 28 and September 12, 2025. The firm discovered on December 23, 2025, that personal information (names, SSNs, DOBs) was accessed. Goodwin engaged third-party forensic investigators, secured the network, and is offering complimentary credit monitoring to affected individuals. Notification letters were mailed starting January 15, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 117 days

discovery → filing · 28 days

Aug 28, 2025

Begins

Dec 23, 2025

Discovered

Jan 20, 2026

Filed

vs. sector median

15 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_040b65ac4ba969282026-01-15 · +5dVerified
Indiana State AGbd_60e36d69946b4a222026-01-15 · +5dCandidate

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Goodwin Partners, LLP
norm: goodwin partners
Industry: Professional Servicesllm

Discovered: Dec 23, 2025
Breach occurred: Aug 28, 2025 – Sep 12, 2025
Undetected for: 117 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 15, 2026
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Launched an investigation and contained and secured the network
Worked very closely with third-party cybersecurity professionals
Conducted a thorough forensic investigation and internal document review
Providing the potentially affected residents with notification of this incident
Offering the potentially affected residents whose Social Security number were potentially impacted with complimentary credit-monitoring services
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Vermont State AGJan 15 · first

Indiana State AGJan 15 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jan 15 (VT), last Jan 20 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/goodwin-partners-20260120.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 20, 2026
Raw hash: 4f74719ed2a017e6d47e257d6d306c379493006830009a7a239a12878c720903

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityGoodwin Partners, LLP

Incidentdiscovered Dec 23, 2025

Stated responseLaunched an investigation and contained and secured the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov