HackingFinancial ServicesFinanceData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPHIHealth (basic)MediumContained

SunSource

bd_bb7a53ac1cb8475f · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 16, 2026

To disclose

—

Affected

30state residents only

Linked

3 filings

Confidence

66%

Full breach record for SunSource →

SunSource Borrower LLC notified the NH Attorney General that an unknown third party accessed its network between March 31 and April 5, 2026, acquiring files containing personal information of 30 New Hampshire residents. Affected data included names, dates of birth, health insurance information, medical information, and Social Security or tax identification numbers. The company engaged forensic experts, contained the incident, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Mar 31, 2026

Begins

Jun 16, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepayoutskingbd_de73edefbf20ef452026-04-20 · +57dVerified by operator

Regulatory filings (1) · sorted by filing gap

Vermont State AGbd_519ba464dfc363e32026-06-17 · +1dVerified

Name: SunSource Borrower LLC
norm: sunsource borrower

Name: SunSource
norm: sunsource
Domain: sunsourceus.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Mar 31, 2026 – Apr 5, 2026
Materiality determined: —
Notification sent: Jun 16, 2026
Affected individuals: 30state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified the Attorney General of the State of New Hampshire

During the incident: Began an initial internal investigation
Worked to contain its network
Engaged an outside third-party forensic expert to investigate the issue and confirm the security of its network
Mailing notification letters to individuals via USPS
Arranged for a toll-free, dedicated call line to assist in responding to inquiries
Offered complimentary credit monitoring services
Changes made: Reviewing its technical security measures
Reviewing its technical and security safeguards
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 16 · first · this page

Vermont State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sunsource-borrower-20260616.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2026
Raw hash: c8e7d898042e74b5044370454ede80a0a94f0d8c875f79414aead284dfa53c13

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entitySunSource Borrower LLC

Victim entitySunSource

IncidentUnauthorized Access

Stated responseBegan an initial internal investigation

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov