FEDERALHackingTechnologyInformationLowContained

Aurora acquisition

bd_e6e7c98662de1b4a · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 31, 2022

Filed

Mar 27, 2026

To disclose

51 months

Affected

Not disclosed

Confidence

64%

Full breach record for Aurora acquisition →

SEC 10-K Item 1C disclosure regarding a cybersecurity attack on computer systems related to the 'Aurora acquisition' detected on January 31, 2022. The systems were not yet integrated into the main company infrastructure. The company isolated the systems, engaged a forensic firm, and determined no critical data was accessed. The incident was contained and the systems were integrated in 2024.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 51 months / 1516 days

Jan 31, 2022

Discovered

Mar 27, 2026

Filed

vs. sector median

+198 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.No incident reportedView incident

Name: HYDROFARM HOLDINGS GROUP, INC.
norm: hydrofarm holdings
SEC CIK: 1695295

Name: Aurora acquisition
norm: aurora acquisition
Also named: HYDROFARM HOLDINGS GROUP, INC.operating subsidiary ofholding company
Industry: Technologyllm

Discovered: Jan 31, 2022
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: —
Attack vector: Unknown
Threat actor: External

During the incident: Took systems offline in an abundance of caution
Engaged an outside cybersecurity forensics firm
Investigated the attack to determine its nature, scope, duration, and impacts
Changes made: Integrated the acquisition’s systems with our main systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 51 months(1516 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1695295/000169529526000010/hyfm-20251231.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 27, 2026
Raw hash: 3bfc721ab0423bbe7a984ca0017986a288434e1c2d5e82e5142e03ad890b6ece

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 MB

Download View at source

Reporting entityHYDROFARM HOLDINGS GROUP, INC.

Victim entityAurora acquisition

Incidentdiscovered Jan 31, 2022

Stated responseTook systems offline in an abundance of caution

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing