DisclosureLens
HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumActive

New York City Regional Center

bd_f0af0fe4ced0e813 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2026

Filed

Aug 5, 2026

To disclose

14 weeks

Affected

4state residents only

Linked

3 filings

Confidence

65%
Full breach record for New York City Regional Center →

New York City Regional Center, LLC notified the NH Attorney General of a data breach affecting 4 NH residents. An unauthorized actor accessed systems and exfiltrated data between March 30 and April 27, 2026. NYCRC became aware of suspicious activity on April 27, 2026. Affected data includes names and Social Security numbers, and potentially driver's license numbers. The investigation is ongoing. NYCRC engaged external cybersecurity experts, notified federal law enforcement, and is offering 24 months of credit monitoring via Kroll.

Incident timeline

undetected · 28 days
discovery → filing · 14 weeks / 100 days

Mar 30, 2026

Begins

Apr 27, 2026

Discovered

Aug 5, 2026

Filed

vs. sector median

+5 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Filing propagation · 3 filings · 3 states

View merged incident ↗
California State AGAug 5 · first
Massachusetts State AGAug 5 · first
New Hampshire State AGAug 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.