HackingProfessional ServicesProfessional ServicesVulnerability ExploitData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Rhodes, Young, Black, and Duncan

bd_b25566f2bd3200e9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 12, 2025

Filed

Jun 29, 2026

To disclose

37 weeks

Affected

7state residents only

Linked

6 filings

Confidence

66%

Full breach record for Rhodes, Young, Black, and Duncan →2 incidents on file

Rhodes, Young, Black, and Duncan (RYBD) notified the New Hampshire Attorney General of a cybersecurity incident affecting 7 NH residents. Unauthorized access occurred on September 17, 2025, via a SonicWall firewall vulnerability, leading to data exfiltration. RYBD detected the breach on October 12, 2025, secured the network, and engaged third-party forensic investigators. Personal information compromised included names, SSNs, and driver's license numbers. RYBD is offering complimentary credit monitoring to affected residents.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 25 days

discovery → filing · 37 weeks / 260 days

Sep 17, 2025

Begins

Oct 12, 2025

Discovered

Jun 29, 2026

Filed

vs. sector median

+19 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_29db5ca2b0472d4d2026-06-27 · +2dVerified
Nebraska State AGbd_09615de228572e2f2026-06-26 · +3dVerified
Indiana State AGbd_393ca5d3b08226e82026-06-26 · +3dVerified
Massachusetts State AGbd_db700247ccd17ccf2026-07-14 · +15dVerified

Show 1 more filing ↓up to 33d gap

Massachusetts State AGbd_62dd36e87f691f132026-08-01 · +33dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Rhodes, Young, Black, and Duncan
norm: rhodes young black and duncan
Industry: Professional Servicesllm

Discovered: Oct 12, 2025
Breach occurred: Sep 17, 2025
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 26, 2026
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Secured its network
Commenced a prompt and thorough investigation
Worked very closely with third-party cybersecurity professionals
Conducted an extensive forensic investigation and manual document review
Activated its incident response plan
Launched an investigation with the assistance of outside cybersecurity and legal professionals
Changes made: Offering the potentially affected residents whose Social Security number was potentially impacted with complimentary credit-monitoring services
Providing you with access to months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed id theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(260 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Nebraska State AGJun 26 · first

Indiana State AGJun 26 · first

Massachusetts State AG+1d

New Hampshire State AG+3d · this page

Massachusetts State AG+18d

Massachusetts State AG+36d

Pattern: first filing Jun 26 (NE), last Aug 1 (MA) — a 36-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rhodes-young-black-duncan-20260629.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2026
Raw hash: 91dda731adff765aef9bd64637ebe4d68d2806e6a217b4fa9589f2c35b6bc010

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityRhodes, Young, Black, and Duncan

Incidentdiscovered Oct 12, 2025

Stated responseSecured its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov