MalwareOtherRansomwareINC RansomwareSupply Chain (3P Vendor)Ransom DemandedCustomer Data InvolvedFinancialIdentity (basic)Government IDMediumContained

National Boat Owners Association

bd_d5d1d694f5cc4f7e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2025

Filed

Jan 21, 2026

To disclose

33 weeks

Affected

154state residents only

Linked

8 filings

Confidence

65%

Full breach record for National Boat Owners Association →

National Boat Owners Association (NBOA) experienced a ransomware intrusion attributed to the INC Ransomware group between mid-May and early June 2025. The attacker accessed NBOA systems via a compromised managed service provider. NBOA discovered the intrusion on June 6, 2025. Affected data may include full names, addresses, and insurance policy numbers. NBOA terminated the MSP, engaged forensic investigators, notified law enforcement, and is offering 24 months of Experian IdentityWorks to affected individuals.

J jump to incidentP pin to compareR raw source

Massachusetts clock✗ MA AG >90d33 weeks discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 33 weeks / 229 days

May 15, 2025

Begins

Jun 6, 2025

Discovered

Jan 21, 2026

Filed

vs. sector median

+25 wks slower

This filing is one of 8 about the same incident.View merged incident

A leak claim by inc_ransom about this victim predates this filing by 229 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteinc_ransombd_1eb9c13c8b6ad8252025-07-20 · +185dVerified by operator
Leak Siteinc_ransombd_775d58a0be3d720e2025-06-06 · +229dVerified by operator

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_8d4fe3831e5cb9352026-01-21Verified
Vermont State AGINC Ransomwarebd_8ff90622a15435c82026-01-21Verified
Nebraska State AGINC Ransomwarebd_b9e1a4217679f73a2026-01-21Verified by operator
Maine State AGINC Ransomwarebd_f3a0730eb7cc86292026-01-21Verified

Show 1 more filing ↓up to 2d gap

New Hampshire State AGINC Ransomware organizationbd_c37fbcbeddd97f1d2026-01-23 · +2dVerified by operator

Name: National Boat Owners Association
norm: national boat owners association
Domain: nboat.com

Name: National Boat Owners Association
norm: national boat owners association
Domain: nboat.com
Industry: Otherllm

Discovered: Jun 6, 2025
Breach occurred: May 15, 2025 – Jun 7, 2025
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 21, 2026
Affected individuals: 154state-resident count only
Data types: FinancialIdentity (basic)Government ID
Attack vector: Ransomware· INC Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: INC RansomwareExternalFinancial
Third party: via managed service provider
Initial access: supply_chain

During the incident: Terminated the services of the managed service provider in question
Engaged a nationally recognized forensic firm to conduct a comprehensive investigation
Reviewed its existing policies and procedures
Implemented additional safeguards to further secure its systems and the information they contain
Notified law enforcement
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: Implemented additional safeguards to further secure its systems and the information they contain
Continues to enhance its systems to help ensure that an incident of this nature does not occur again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(229 days from discovery to filing)
Compliance flags: MA AG >90dLeak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGJan 21 · first

Vermont State AGJan 21 · first

Nebraska State AGJan 21 · first

Maine State AGJan 21 · first

Massachusetts State AGJan 21 · first · this page

New Hampshire State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-91-national-boat-association/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 21, 2026
Raw hash: 557e2ede9dba6852a356e9922d07013fbb64340e4802e4c7d049e068bea0f4b7

Linked disclosures

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Reporting entityNational Boat Owners Association

Victim entityNational Boat Owners Association

Incidentdiscovered Jun 6, 2025

Stated responseTerminated the services of the managed service provider in question

ComplianceMA AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov