Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

ASSETMARK, INC.

bd_c7f8a628cbde3f8a · schema v1 · pii pii-v1

Severity

High

Discovered

May 15, 2026

Filed

Jun 11, 2026

To disclose

27 days

Affected

3,751state residents only

Linked

11 filings

Confidence

66%

Full breach record for ASSETMARK, INC. →2 incidents on file

AssetMark, Inc., a wealth management platform, notified the NH AG of a data breach affecting 3,751 NH residents. On May 15, 2026, an employee's credentials were compromised via social engineering, leading to unauthorized access and exfiltration of customer files containing names, SSNs, and account numbers. AssetMark disabled credentials, engaged forensics, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 days

May 15, 2026

Begins

May 15, 2026

Discovered

Jun 11, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Washington State AGbd_33f04a386aea24d32026-06-11Verified
Oregon State AGbd_6886b6cefdfdb7fd2026-06-11Verified
Delaware State AGbd_6af2c69a79abc5b22026-06-11Verified
Nebraska State AGbd_7ac3f8543828d6ee2026-06-11Verified

Show 6 more filings ↓up to 27d gap

Vermont State AGbd_d0136116688cfee02026-06-11Verified
Massachusetts State AGbd_6ed05ad3f644267a2026-06-12 · +1dCandidate
Rhode Island State AGbd_e099e3ab62a709032026-06-15 · +4dVerified
Texas State AGbd_30436bcce43994592026-06-18 · +7dVerified
California State AGbd_b328f99afc4a52512026-06-26 · +15dVerified
Rhode Island State AGbd_cb19c05bc1b11d032026-07-08 · +27dVerified

Name: AssetMark, Inc.
norm: assetmark
Domain: kyl.com

Name: ASSETMARK, INC.
norm: assetmark
Industry: Financial Servicesllm

Discovered: May 15, 2026
Breach occurred: May 15, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2026
Affected individuals: 3,751state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified New Hampshire Department of Justice Consumer Protection & Antitrust BureauProviding notice of this incident to state regulators, as necessaryNotified the three major credit reporting agencies: Equifax, Experian, and TransUnion
Initial access: phishing_link

During the incident: Disabled the compromised employee’s credentials
Engaged third-party incident response team and a forensic expert to assist with the investigation
Initiated enhanced monitoring and investigative review of affected systems
Instituted physical safeguards including access restrictions
Mandatory password changes for all employees
Initiated an enterprise-wide employee awareness and communications campaign to educate employees about the signs and risks of social-engineering campaigns
Notified federal law enforcement of the event
Implemented additional safeguards
Changes made: Providing individuals whose personal information was potentially affected by this incident with access to twenty-four (24) months of complimentary credit monitoring and identity restoration services through Epiq Privacy Solutions
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing contact details for the national consumer reporting agencies
Providing information on how to obtain a free credit report
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

Washington State AGJun 11 · first

Oregon State AGJun 11 · first

Delaware State AGJun 11 · first

Nebraska State AGJun 11 · first

Vermont State AGJun 11 · first

New Hampshire State AGJun 11 · first · this page

Massachusetts State AG+1d

Rhode Island State AG+4d

Texas State AG+7d

California State AG+15d

Rhode Island State AG+27d

Pattern: first filing Jun 11 (WA), last Jul 8 (RI) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/assetmark-20260611.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2026
Raw hash: 71fb419e6a207fba16e3a8e88847f43f7cb2be08279c76baea22d38ad6263a7d

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAssetMark, Inc.

Victim entityASSETMARK, INC.

Incidentdiscovered May 15, 2026

Stated responseDisabled the compromised employee’s credentials

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov