HackingRetail & ConsumerRetailStolen CredentialsData ExfiltratedData PublishedCustomer Data InvolvedIdentity (basic)Government IDHighContained

HARNISH GROUP INC.

bd_da95636ccea25b75 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 11, 2025

Filed

Dec 29, 2025

To disclose

7 weeks

Affected

1,435state residents only

Linked

4 filings

Confidence

71%

Full breach record for HARNISH GROUP INC. →

Harnish Group Inc. notified Washington employees of a cyberattack occurring Nov 6-11, 2025. Attackers used compromised credentials to access employee PII (names, SSNs) and published files on Dec 9, 2025. 1,435 Washington residents affected. Forensic investigation completed; network changes implemented. Norton LifeLock monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d7 weeks discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

undetected · 5 days

discovery → filing · 7 weeks / 48 days

Nov 6, 2025

Begins

Nov 11, 2025

Discovered

Dec 29, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_33f0b6908af9263a2025-12-31 · +2dVerified
Maine State AGbd_92841ba5998dd7632025-12-31 · +2dVerified
Indiana State AGbd_bf3d428b82f784ad2025-12-22 · +7dVerified

Name: HARNISH GROUP INC.
norm: harnish group

Name: HARNISH GROUP INC.
norm: harnish group
Industry: Retail & Consumerllm

Discovered: Nov 11, 2025
Breach occurred: Nov 6, 2025 – Nov 11, 2025
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 11, 2025
Affected individuals: 1,435state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Washington Attorney General
Initial access: valid_credentials

During the incident: Hired experts to conduct an in-depth forensic investigation
Partnered with Norton LifeLock to provide 2-year subscription for identity theft monitoring services
Changes made: Completed all changes to network to prevent this attack from reoccurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGDec 22 · first

Washington State AG+7d · this page

Montana State AG+9d

Maine State AG+9d

Pattern: first filing Dec 22 (IN), last Dec 31 (ME) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA35969.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2025
Raw hash: a6f4b93de2a1f59f5636491a6fc1c0beb911ab7ec4677b9aeb72178cadac6f91

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHARNISH GROUP INC.

Victim entityHARNISH GROUP INC.

Incidentdiscovered Nov 11, 2025

Stated responseHired experts to conduct an in-depth forensic investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com