HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Man Group

bd_b2c4b41bba72fc38 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 22, 2026

Filed

Sep 21, 2026

To disclose

22 weeks

Affected

1state residents only

Linked

2 filings

Confidence

70%

Full breach record for Man Group →2 incidents on file

Man Group notified the NH Attorney General of a data breach affecting 1 New Hampshire resident. The incident occurred via a third-party IT service management platform used by Ernst & Young LLP (EY), Man Group's tax service provider. Between March 28 and April 12, 2026, an unauthorized third party accessed the platform and downloaded documents containing personal information, including names, Social Security numbers, and financial information related to tax filings. EY identified anomalous activity on April 22, 2026, and confirmed unauthorized access on April 23, 2026. EY contained the incident, engaged forensic investigators, and notified law enforcement. Affected individuals are offered 24 months of credit and identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 25 days

discovery → filing · 22 weeks / 152 days

Mar 28, 2026

Begins

Apr 22, 2026

Discovered

Sep 21, 2026

Filed

vs. sector median

+13 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_2c649fc03ede13802026-09-23 · +2dCandidate

Name: Man Group
norm: man group

Name: Man Group
norm: man group
Industry: Financial Servicesllm

Discovered: Apr 22, 2026
Breach occurred: Mar 28, 2026 – Apr 12, 2026
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 21, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Ernst & Young LLP

During the incident: Working with an independent cybersecurity firm to investigate and contain the incident
Confirming that EY has stopped the unauthorized access and secured the affected systems
Launching ongoing monitoring for further information associated with this incident
Notifying federal law enforcement of the incident
Changes made: Offering complimentary 24-month Experian Identity Works credit and identity monitoring memberships and Identity Restoration services at no cost to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(152 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 21 · first · this page

Indiana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/man-group-20260921.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 21, 2026
Raw hash: a77796a934338c4a464b96afbf680927a74ecde6dcfc07873802880406c29221

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMan Group

Victim entityMan Group

Incidentdiscovered Apr 22, 2026

Stated responseWorking with an independent cybersecurity firm to investigate and contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov