AccidentalProfessional ServicesProfessional ServicesMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Cross Recruiting Inc.

bd_deb791378d78c1c1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 19, 2026

Filed

Jun 29, 2026

To disclose

6 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Cross Recruiting Inc. →

Cross Recruiting Inc. (dba Cross Resource Group) notified the New Hampshire Attorney General on June 29, 2026, of a cybersecurity incident discovered on May 19, 2026. An employee inadvertently disclosed personal information of one New Hampshire resident to an unauthorized recipient. Exposed data included names, DOB, address, SSN, and tax info. CRG engaged security experts, requested data deletion, and provided 24 months of credit monitoring via TransUnion. The incident is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 41 days

May 19, 2026

Discovered

Jun 29, 2026

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_ecd1bdb3c58e823b2026-06-26 · +3dCandidate
Indiana State AGbd_95beb1b9a524f9d42026-06-18 · +11dVerified

Name: DINSMORE & SHOHL LLP
norm: dinsmore shohl

Name: Cross Recruiting Inc.
norm: cross recruiting
Also named: Cross Recruiting Inc.dba oflegal entity
Cross Resource Groupdba oftrade name
Industry: Professional Servicesllm

Discovered: May 19, 2026
Materiality determined: —
Notification sent: Jun 18, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1566 Phishing
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Engaged cyber security experts to launch an investigation
Requested deletion or destruction of the information
Confirmed that it had not been further shared or used
Provided affected individuals notice of the security incident via U.S. mail
Secured the services of TransUnion to establish 24-month no-cost credit and dark web monitoring
Established a call center to respond to questions
Changes made: Security measures were implemented to contain the Incident and mitigate any potential impact
Working with its IT team and cyber security partner to constantly evaluate security protocols and processes to prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJun 18 · first

Massachusetts State AG+8d

New Hampshire State AG+11d · this page

Pattern: first filing Jun 18 (IN), last Jun 29 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cross-recruiting-cross-resource-group-20260629.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2026
Raw hash: 46e8df7412e28d4b9e1c4bb0904511680aef52e65b9be54f3bb80a1bb097c1bf

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDINSMORE & SHOHL LLP

Victim entityCross Recruiting Inc.

Incidentdiscovered May 19, 2026

Stated responseEngaged cyber security experts to launch an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov