HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Adsuar Muñíz Goyco Seda & Pérez Ochoa PSC

bd_d33c35ea8bd4a0ee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2025

Filed

Nov 21, 2025

To disclose

38 weeks

Affected

7state residents only

Linked

4 filings

Confidence

66%

Full breach record for Adsuar Muñíz Goyco Seda & Pérez Ochoa PSC →

Adsuar Muñíz Goyco Seda & Pérez Ochoa PSC, a law firm, notified the New Hampshire Attorney General of a data security incident affecting 7 state residents. Unauthorized access to files occurred between February 19 and 26, 2025. The firm discovered the disruption on February 26, 2025, and confirmed the involvement of personal information (names and SSNs) on October 23, 2025. Notices were sent on November 21, 2025, offering credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 38 weeks / 268 days

Feb 19, 2025

Begins

Feb 26, 2025

Discovered

Nov 21, 2025

Filed

vs. sector median

+20 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_4ddc44894835d3ec2025-11-21Verified
Vermont State AGbd_d33c2d53ad6c2db22025-11-21Candidate
Massachusetts State AGbd_80bbf1b74e4b92c52025-11-22 · +1dVerified

Name: Dykema
norm: dykema
Domain: dykema.com

Name: Adsuar Muñíz Goyco Seda & Pérez Ochoa PSC
norm: adsuar muniz goyco seda perez ochoa psc
Domain: adsuarlaw.com
Industry: Professional Servicesllm

Discovered: Feb 26, 2025
Breach occurred: Feb 19, 2025 – Feb 26, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 21, 2025
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: exploit_public_facing

During the incident: Engaged cybersecurity specialists to assist with the process
Undertook a comprehensive review of the relevant files
Implemented additional safeguards and policies to enhance the security of its network
Provided access to credit monitoring services, through IDX, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Provided written notice of this event to seven (7) New Hampshire residents via U.S. mail
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Implemented additional safeguards and policies to enhance the security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 weeks(268 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGNov 21 · first

Vermont State AGNov 21 · first

New Hampshire State AGNov 21 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/adsuar-muniz-goyco-seda-perez-ochoa-20251121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2025
Raw hash: 79269327351979c49fd95a7231febc6df5a6012c185113b9db40dcc43d9d369a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDykema

Victim entityAdsuar Muñíz Goyco Seda & Pérez Ochoa PSC

Incidentdiscovered Feb 26, 2025

Stated responseEngaged cybersecurity specialists to assist with the process

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov