HackingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIMediumContained
BFC Solutions
bd_b9d2fc51487edc3a · schema v1 · pii pii-v1
Full breach record for BFC Solutions →BFC Solutions notified New Hampshire AG of a data breach affecting 13 state residents. Unauthorized access occurred June 18-20, 2024, involving names, DOB, driver's licenses, financial accounts, PHI, and SSNs. Notification mailed August 14, 2025. Response included forensic investigation, law enforcement notification, and credit monitoring services.
Leak gap clock✗ Leak >180d14 months discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 4 about the same incident.View merged incident
A leak claim by ransomhub about this victim predates this filing by 403 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_9c19d279fe535bd1Texas State AGfiled 2025-08-15(3d gap)Verified
- bd_30929684183bd71aMaine State AGfiled 2025-08-14(4d gap)Candidate
- bd_5e401a63f130cfd7Indiana State AGfiled 2025-08-14(4d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bfc-solutions-20250818.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 18, 2025
- Raw hash
- df55c279ff56b44bb3acd39c0c1ef0af95697cdc6b4f388614d4333b8f66e3ad
Reporting entity
- Name
- BFC Solutionsnorm: bfc solutions
- Domain
- bfcsolutions.com
Victim entity
- Name
- BFC Solutionsnorm: bfc solutions
- Domain
- bfcsolutions.com
Incident
- Discovered
- Jun 20, 2024
- Materiality determined
- —
- Notification sent
- Aug 14, 2025
- Affected individuals
- 13
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHI
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 months(424 days from discovery to filing)
- Compliance flags
- Leak >180d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.