HackingConstructionProfessional ServicesConstructionStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

ABC Supply Co., Inc

bd_a558ec11b5ff8a67 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2026

Filed

Aug 6, 2026

To disclose

18 weeks

Affected

12state residents only

Linked

3 filings

Confidence

65%

Full breach record for ABC Supply Co., Inc →

ABC Supply Co., Inc. notified the NH Attorney General of a data breach where an unauthorized actor accessed Microsoft 365 email accounts from March 10 to April 7, 2026. The company identified suspicious activity on April 1, 2026. Approximately 12 New Hampshire residents were affected, with potential exposure of names, addresses, dates of birth, Social Security numbers, and driver's license numbers. The incident has been contained. ABC Supply is offering 24 months of credit monitoring and identity theft protection through IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 18 weeks / 127 days

Mar 10, 2026

Begins

Apr 1, 2026

Discovered

Aug 6, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_a0ca9010429a22c92026-08-07 · +1dCandidate
Vermont State AGbd_6bee492b2b071dc82026-08-11 · +5dVerified

Name: ABC Supply Co., Inc
norm: abc supply

Name: ABC Supply Co., Inc
norm: abc supply
Industry: ConstructionllmProfessional Servicesllm

Discovered: Apr 1, 2026
Breach occurred: Mar 10, 2026 – Apr 7, 2026
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2026
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Launched an investigation into the nature and scope of this activity
Took steps to secure its Microsoft 365 environment and its systems
Engaged cybersecurity experts as well as outside counsel to assist with its investigation and response to the incident
Continues to monitor its systems for any suspicious activity
Changes made: Implemented additional measures designed to enhance the security of its systems
Will continue to evaluate additional steps that may be taken to further increase its cybersecurity posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(127 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGAug 6 · first · this page

Massachusetts State AG+1d

Vermont State AG+5d

Pattern: first filing Aug 6 (NH), last Aug 11 (VT) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/abc-supply-20260806.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 6, 2026
Raw hash: d3daf77664f7a1f3fd3dbf8bdb340563aeb9b4118b3744efb567bb0182aa4f0b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityABC Supply Co., Inc

Victim entityABC Supply Co., Inc

Incidentdiscovered Apr 1, 2026

Stated responseLaunched an investigation into the nature and scope of this activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov