HackingFinancial ServicesFinanceCustomer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

KerberRose

bd_df731ff4766cb144 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 1, 2026

Filed

May 29, 2026

To disclose

28 days

Affected

6state residents only

Linked

6 filings

Confidence

66%

Full breach record for KerberRose →

KerberRose Wealth Management, LLC notified Massachusetts residents of a data security incident discovered on May 1, 2026. The breach potentially exposed customer names, addresses, Social Security numbers, financial account numbers, and dates of birth. KerberRose isolated the environment, engaged forensic investigators, and offered 24 months of credit monitoring via Cyberscout. No evidence of fraud was found at the time of notification.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d28 days discovery → filing

Incident timeline

discovery → filing · 28 days

May 1, 2026

Discovered

May 29, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Nebraska State AGbd_38b9df400b66b7512026-05-29Verified
Vermont State AGbd_971065d86a0267032026-05-29Verified
Maine State AGbd_b053396543ca5b5e2026-05-29Verified
Indiana State AGbd_b5592268966c1f842026-05-29Verified

Show 1 more filing ↓

New Hampshire State AGbd_f7e6792d830978ee2026-05-29Verified

Name: KerberRose
norm: kerberrose
Domain: kerberrose.com

Name: KerberRose
norm: kerberrose
Domain: kerberrose.com
Industry: Financial Servicesllm

Discovered: May 1, 2026
Materiality determined: —
Notification sent: May 29, 2026
Affected individuals: 6state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Isolated the impacted environment
Engaged a leading forensic security firm
Provided 24-months of identity monitoring and theft resolution services through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Nebraska State AGMay 29 · first

Vermont State AGMay 29 · first

Maine State AGMay 29 · first

Indiana State AGMay 29 · first

New Hampshire State AGMay 29 · first

Massachusetts State AGMay 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-876-kerberrose-sc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2026
Raw hash: 8da7c778a0c16fd9cc50a3c27029b3364d0004da81430346fd03ee759a51801b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityKerberRose

Victim entityKerberRose

Incidentdiscovered May 1, 2026

Stated responseIsolated the impacted environment

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov