HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Metropolitan Marine Maintenance Contractors' Association, Inc.

bd_de025790cd75f18c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 7, 2026

Filed

Jun 17, 2026

To disclose

10 weeks

Affected

14state residents only

Linked

5 filings

Confidence

68%

Full breach record for Metropolitan Marine Maintenance Contractors' Association, Inc. →

Metropolitan Marine Maintenance Contractors' Association (MMMCA) notified the New Hampshire Attorney General of a security incident discovered on April 7, 2026. An unknown threat actor accessed the MMMCA and Metro-ILA Funds' environment via a VPN. The breach impacted 14 New Hampshire residents, exposing names, SSNs, DOBs, and financial account data. MMMCA engaged forensic experts, took the VPN offline, reset passwords, and notified law enforcement and credit bureaus. Affected individuals received 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 71 days

Apr 7, 2026

Discovered

Jun 17, 2026

Filed

vs. sector median

9 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_5a911fe14272f2782026-06-18 · +1dVerified
Vermont State AGbd_5c0b93e753c3de202026-05-26 · +22dVerified
Maine State AGbd_234af4562f4ff4e42026-05-25 · +23dCandidate
Indiana State AGbd_42594df9051817a62026-05-22 · +26dVerified

Name: Metropolitan Marine Maintenance Contractors' Association, Inc.
norm: metropolitan marine maintenance contractors
Domain: mmmca.org

Name: Metropolitan Marine Maintenance Contractors' Association, Inc.
norm: metropolitan marine maintenance contractors
Domain: mmmca.org
Industry: Professional Servicesllm

Discovered: Apr 7, 2026
Materiality determined: —
Notification sent: Jun 18, 2026
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified the Office of the New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: external_remote_services

During the incident: Engaged third-party forensic and data-mining experts
Engaged Level Blue as a third-party forensic firm to confirm eradication of any unauthorized access
Notified law enforcement
Notified the major consumer reporting agencies (i.e., Equifax, Experian, and TransUnion) on May 28, 2026
Offered twelve (12) months of free credit monitoring services from Experian
Changes made: Reviewing and enhancing SentinelOne configurations
Taking the impacted VPN offline
Requiring password resets across its environment
Reviewing data retention policies
Evaluating managed service provider options
Conducting a broader review of its cybersecurity and privacy practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGMay 22 · first

Maine State AG+3d

Vermont State AG+4d

New Hampshire State AG+26d · this page

Vermont State AG+27d

Pattern: first filing May 22 (IN), last Jun 18 (VT) — a 27-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/metropolitan-marine-maintenance-contractors-association-20260617.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 17, 2026
Raw hash: 28bd3857e86f85aac036cd8919f140418cc6105c5b589b354ac0351dcd939fd4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMetropolitan Marine Maintenance Contractors' Association, Inc.

Victim entityMetropolitan Marine Maintenance Contractors' Association, Inc.

Incidentdiscovered Apr 7, 2026

Stated responseEngaged third-party forensic and data-mining experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov