MalwareRansomwareINC Ransomware organizationInc RansomData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedTargetedPIIIDENTITY_BASICMediumContained

National Boat Owners Association

bd_c37fbcbeddd97f1d · schema v1 · pii pii-v1

Full breach record for National Boat Owners Association →

National Boat Owners Association (NBOA) reported a ransomware incident involving the INC Ransomware group, attributed to a compromise of a managed service provider (supply chain). The breach occurred mid-May to early June 2025 and was discovered on June 6, 2025. NBOA notified the NH Attorney General on January 23, 2026. 3,580 individuals were affected (40 NH residents), with data including names, addresses, and insurance policy numbers. No exfiltration was confirmed. NBOA terminated the MSP, engaged forensic investigators, and offered 24 months of credit monitoring via Experian.

Leak gap clock✗ Leak >180d33 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,580 affectedView incident

A leak claim by inc_ransom about this victim predates this filing by 231 days.View originating leak claim

Source provenance

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/national-boat-owners-association-20260123.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2026
Raw hash: 0fd5515baa9a1cacb748bae90a7435d210ad2ee9937b2d1473bd6739ea46e5b4

Reporting entity

Name: Mandelbaum Barrett PC
norm: mandelbaum barrett
Domain: mblawfirm.com

Victim entity

Name: National Boat Owners Association
norm: national boat owners association
Domain: nboat.com

Incident

Discovered: Jun 6, 2025
Materiality determined: —
Notification sent: Jan 21, 2026
Affected individuals: 3,580
Data types: PIIIDENTITY_BASIC
Attack vector: Third-Party / Supply Chain· INC Ransomware organization
MITRE ATT&CK: T1195 Supply Chain CompromiseT1486 Data Encrypted for Impact
Threat actor: INC Ransomware organizationExternalFinancial
Regulator citations: Submitted notification to NH Department of Justice Consumer Protection & Antitrust Bureau
Initial access: supply_chain

Compliance

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Extraction provenance

Status: No extraction artifact recorded for this disclosure.