HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

UHY

bd_f3392e9a209583f8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2025

Filed

Apr 27, 2026

To disclose

25 weeks

Affected

19state residents only

Linked

3 filings

Confidence

67%

Full breach record for UHY →

UHY Advisors Northeast, Inc. notified the NH Attorney General that an unauthorized individual may have accessed an employee's email account on November 6, 2025. The investigation, which is ongoing, determined that the account contained personal information for approximately 19 New Hampshire residents, including names, Social Security numbers, driver's license/state ID numbers, financial account information, and taxpayer identification numbers. The company engaged outside cybersecurity professionals and is offering credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 25 weeks / 172 days

Nov 6, 2025

Discovered

Apr 27, 2026

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Nebraska State AGbd_c81abb52a3e3e2542026-04-17 · +10dVerified
Massachusetts State AGbd_53f9833708acae952026-04-13 · +14dVerified

Name: UHY Advisors Northeast, Inc.
norm: uhy advisors northeast

Name: UHY
norm: uhy
Domain: uhy-us.com
Industry: Professional Servicesllm

Discovered: Nov 6, 2025
Materiality determined: —
Notification sent: Apr 17, 2026
Affected individuals: 19state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the Office of the Attorney General of New Hampshire

During the incident: Immediately launched an investigation in consultation with outside cybersecurity professionals
Offering the affected residents complimentary one-year memberships with a credit monitoring service
Advising the affected residents about the process for placing fraud alerts and/or security freezes on their credit files
Providing the affected residents with the contact information for the consumer reporting agencies and the Federal Trade Commission
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(172 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGApr 13 · first

Nebraska State AG+4d

New Hampshire State AG+14d · this page

Pattern: first filing Apr 13 (MA), last Apr 27 (NH) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/uhy-advisors-northeast-20260427.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 27, 2026
Raw hash: 3c4881f045f5cec54cb82c9d811eab8b56473ad0e2c35bbde8604d30a6c7a5a1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUHY Advisors Northeast, Inc.

Victim entityUHY

Incidentdiscovered Nov 6, 2025

Stated responseImmediately launched an investigation in consultation with outside cybersecurity professionals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov