Social EngineeringRetail & ConsumerRetailPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Rock Solid Retail

bd_ca045cb4fd6e77d2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2025

Filed

Jun 2, 2025

To disclose

6 weeks

Affected

1state residents only

Confidence

66%

Full breach record for Rock Solid Retail →2 incidents on file

Rock Solid Retail d/b/a Nuqleous notified the NH AG of a phishing incident affecting 1 NH resident. Unauthorized access to two employee email accounts occurred between Sept 28, 2024 and Feb 27, 2025. Discovery occurred April 23, 2025. Data exposed: name and SSN. Remediation includes credit monitoring and forensic investigation.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 207 days

discovery → filing · 6 weeks / 40 days

Sep 28, 2024

Begins

Apr 23, 2025

Discovered

Jun 2, 2025

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Rock Solid Retail
norm: rock solid retail
Also named: Rock Solid Retaildba oflegal entity
Nuqleousdba oftrade name
Industry: Retail & Consumerllm

Discovered: Apr 23, 2025
Breach occurred: Sep 28, 2024 – Feb 27, 2025
Undetected for: 207 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 23, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Worked closely with external professionals experienced in handling these types of incidents
Forensic investigation confirmed unauthorized access
Provided written notification to the affected resident
Advised the affected resident about the process for placing fraud alerts and/or security freezes
Provided complimentary credit monitoring services for 12 months
Changes made: Continually evaluates and modifies practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(40 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/rock-solid-retail-nuqleous-20250602.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2025
Raw hash: fd32575f79fa8d5a4ebcff3ecc838ff671e09e28c40175f80df1d31549044421

Reporting entityMCDONALD HOPKINS LLC

Victim entityRock Solid Retail

Incidentdiscovered Apr 23, 2025

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov