HackingRetail & ConsumerRetailCustomer Data InvolvedFinancial accountIdentity (basic)Government IDPCIMediumContained

Janome America, Inc.

bd_ad8458e4bc8ee3c6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 8, 2025

Filed

Jul 31, 2026

To disclose

42 weeks

Affected

77state residents only

Linked

3 filings

Confidence

66%

Full breach record for Janome America, Inc. →

Janome America, Inc. notified Massachusetts residents of a data security incident discovered on October 8, 2025. Unauthorized access to files containing personal information (names) occurred, though no evidence of misuse was found. Janome engaged cybersecurity experts and offered TransUnion identity protection services, including credit monitoring and dark web monitoring, to affected individuals. Notification letters were issued on July 10, 2026.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d42 weeks discovery → filing

Incident timeline

discovery → filing · 42 weeks / 296 days

Oct 8, 2025

Discovered

Jul 31, 2026

Filed

vs. sector median

+35 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_6962d368cb3332c12026-07-31Candidate
Nebraska State AGbd_bfc2f1edc003f4f92026-07-10 · +21dVerified

Name: Janome America, Inc.
norm: janome america

Name: Janome America, Inc.
norm: janome america
Industry: Retail & Consumerllm

Discovered: Oct 8, 2025
Materiality determined: —
Notification sent: Jul 10, 2026
Affected individuals: 77state-resident count only
Data types: Financial accountIdentity (basic)Government IDPCI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External

During the incident: Engaged independent cybersecurity experts
Offered complimentary identity protection services through TransUnion
Provided 12 months of credit monitoring
Provided dark web monitoring
Provided $1 million identity fraud loss reimbursement policy
Provided fully managed identity theft recovery services
Changes made: Implemented measures to enhance security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(296 days from discovery to filing)
Compliance flags: MA AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Nebraska State AGJul 10 · first

New Hampshire State AG+21d

Massachusetts State AG+21d · this page

Pattern: first filing Jul 10 (NE), last Jul 31 (MA) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1263-janome-america-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2026
Raw hash: 52a810c290a9546d5206366e7001084d678dd966fae5c6279437d06f35539a47

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityJanome America, Inc.

Victim entityJanome America, Inc.

Incidentdiscovered Oct 8, 2025

Stated responseEngaged independent cybersecurity experts

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov