Social EngineeringOtherPhishingStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Ancora Holdings, LLC

bd_9ea18146109df926 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 2, 2025

Filed

Sep 22, 2025

To disclose

16 weeks

Affected

4state residents only

Linked

4 filings

Confidence

67%

Full breach record for Ancora Holdings, LLC →4 incidents on file

Ancora Holdings Group, LLC notified the NH AG of a data security incident. On June 2, 2025, the company detected suspicious activity in an employee email account, likely due to phishing. An unauthorized individual accessed emails containing names, addresses, SSNs, and financial account info. 4 NH residents were notified on Sept 12, 2025. The company engaged forensic investigators, reset passwords, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 112 days

Jun 2, 2025

Discovered

Sep 22, 2025

Filed

vs. sector median

+8 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_337f9789ad7a5a8a2025-09-23 · +1dVerified
Vermont State AGbd_88455e584e8cec7c2025-09-12 · +10dCandidate
Indiana State AGbd_d80edf90968f49f82025-09-12 · +10dVerified

Name: CLARK HILL PLC
norm: clark hill

Name: Ancora Holdings, LLC
norm: ancora holdings
Industry: Otherllm

Discovered: Jun 2, 2025
Materiality determined: —
Notification sent: Sep 12, 2025
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Department of Justice
Initial access: phishing_link

During the incident: Engaged a third-party forensic firm to assist in the investigation
Took steps to secure its email environment
Performed a global password reset
Implemented additional security controls
Sent notification letters to potentially affected individuals
Offered 12 months of credit monitoring and identity protection services through IDX
Changes made: Implemented additional safeguards and technical security measures
Continued to adopt additional safeguards to further protect and monitor systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGSep 12 · first

Indiana State AGSep 12 · first

New Hampshire State AG+10d · this page

Massachusetts State AG+11d

Pattern: first filing Sep 12 (VT), last Sep 23 (MA) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ancora-holdings-20250922.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 22, 2025
Raw hash: 9e6d7403d449986e3e6344df0a742c1bb92991e701784ecb8d776f4972cd63ec

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCLARK HILL PLC

Victim entityAncora Holdings, LLC

Incidentdiscovered Jun 2, 2025

Stated responseEngaged a third-party forensic firm to assist in the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov