HackingManufacturingManufacturingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

A Y McDonald Industries Inc

bd_aaa7f816df5c824d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 19, 2025

Filed

Oct 21, 2025

To disclose

5 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for A Y McDonald Industries Inc →3 incidents on file

A.Y. McDonald Industries, Inc. notified the New Hampshire Attorney General of a data security incident occurring on or about January 12, 2025. Unauthorized access to the network resulted in the exposure of personal information, including names, SSNs, driver's licenses, passport numbers, and financial account details. One New Hampshire resident was affected. Notifications were sent on October 21, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 250 days

discovery → filing · 5 weeks / 32 days

Jan 12, 2025

Begins

Sep 19, 2025

Discovered

Oct 21, 2025

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_7c60d53c920479ad2025-10-21Verified
Indiana State AGbd_81c38ef1721525ae2025-10-21Candidate
Massachusetts State AGbd_efaa43e3ad6e5bd82025-10-21Verified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: A Y McDonald Industries Inc
norm: a y mcdonald
Industry: Manufacturingllm

Discovered: Sep 19, 2025
Breach occurred: Jan 12, 2025
Undetected for: 250 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged external cybersecurity professionals
Notified federal law enforcement
Conducted a manual review of the impacted files
Providing notice to the affected individuals
Providing complimentary credit monitoring services
Changes made: Reviewing existing policies and training protocols relating to data protection
Enhancing security measures and monitoring tools
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(32 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGOct 21 · first

Indiana State AGOct 21 · first

Massachusetts State AGOct 21 · first

New Hampshire State AGOct 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/a-y-mcdonald-industries-20251021.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 21, 2025
Raw hash: f4bbd6ffd0b17e41bbae5dca982ee0001c1b9e8eef365293f574fa7db4cdc3ed

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityA Y McDonald Industries Inc

Incidentdiscovered Sep 19, 2025

Stated responseEngaged external cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov