HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumActive

The Bowers Group, Inc.

bd_e0fda7fa1858fefc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 16, 2024

Filed

Aug 28, 2025

To disclose

41 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for The Bowers Group, Inc. →

The Bowers Group, Inc. notified the New Hampshire Attorney General of a data event affecting one NH resident. Unauthorized access occurred between Nov 14-16, 2024, via compromised user accounts. Data exposed included PII (names, addresses, emails) and government IDs (SSN, driver's license, passport). The company engaged forensic investigators, reset credentials, blocked IPs, and provided 2 years of Kroll identity monitoring. Notification was sent Aug 20, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 41 weeks / 285 days

Nov 14, 2024

Begins

Nov 16, 2024

Discovered

Aug 28, 2025

Filed

vs. sector median

+21 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_7ff5ef2ca0b73a762025-08-20 · +8dCandidate
Indiana State AGbd_aff6d211105202d82025-08-20 · +8dCandidate

Name: The Bowers Group, Inc.
norm: the bowers

Name: The Bowers Group, Inc.
norm: the bowers
Industry: Professional Servicesllm

Discovered: Nov 16, 2024
Breach occurred: Nov 14, 2024 – Nov 16, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcement of the event
Initial access: valid_credentials

During the incident: Disabling all potentially compromised business partner accounts and terminating all active sessions
Blocking all IP addresses associated with threat actor activity
Implementing a global password reset
Notified law enforcement of the event
Engaged an independent cybersecurity incident response firm to conduct a thorough and comprehensive forensic analysis
Provided credit identity monitoring, insurance, and restoration services for a period of two (2) years
Changes made: Implemented numerous improvements aimed at guarding against risks
Undertaking a thorough review of our existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(285 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Indiana State AGAug 20 · first

New Hampshire State AG+8d · this page

Pattern: first filing Aug 20 (IN), last Aug 28 (NH) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bowers-group-20250828.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2025
Raw hash: 379e9fd95d091abf49420e32e6f0d7f23ea73a87f9c0a13efc7ea3a46117f13d

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityThe Bowers Group, Inc.

Victim entityThe Bowers Group, Inc.

Incidentdiscovered Nov 16, 2024

Stated responseDisabling all potentially compromised business partner accounts and terminating all active sessions

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov