HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

PHILLIP GALYEN

bd_a856f09d7a9a9456 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 4, 2025

Filed

May 20, 2026

To disclose

28 weeks

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for PHILLIP GALYEN →3 incidents on file

Bailey & Galyen, a full-service law firm, notified the NH Attorney General that an unknown actor gained unauthorized access to its network on November 4, 2025, and may have downloaded files containing personal information. The incident affected three New Hampshire residents, whose names and Social Security numbers were potentially compromised. The firm engaged external cybersecurity experts, secured its network, and offered 12 months of identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 28 weeks / 197 days

Nov 4, 2025

Begins

Nov 4, 2025

Discovered

May 20, 2026

Filed

vs. sector median

+9 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_e2c4720b144c29f82026-05-21 · +1dVerified
Massachusetts State AGbd_ea538f6713e1e9e72026-05-21 · +1dCandidate
Indiana State AGbd_760daae48941329f2026-05-19 · +1dVerified
Texas State AGbd_5dbe0e71190febbe2026-05-22 · +2dVerified by operator

Name: PHILLIP GALYEN
norm: phillip galyen

Name: PHILLIP GALYEN
norm: phillip galyen
Also named: Phillip Galyen P.C.dba oflegal entity
Bailey & Galyendba oftrade name
Industry: Professional Servicesllm

Discovered: Nov 4, 2025
Breach occurred: Nov 4, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 19, 2026
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Took steps to ensure the network was secure
Launched an investigation with the support of external cybersecurity experts
Established a toll-free call center to answer questions about the incident
Notified affected individuals by USPS First Class Mail
Offered complimentary identity protection services including 12 months of CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services through IDX
Changes made: Implemented additional security features to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGMay 19 · first

New Hampshire State AG+1d · this page

Vermont State AG+2d

Massachusetts State AG+2d

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/phillip-galyen-bailey-galyen-20260520.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2026
Raw hash: 32af5f4fe056efc7068d666f712a305297c158c36ec00630264474b31a6761eb

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPHILLIP GALYEN

Victim entityPHILLIP GALYEN

Incidentdiscovered Nov 4, 2025

Stated responseTook steps to ensure the network was secure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov