Social EngineeringPhishingCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
KerberRose
bd_f7e6792d830978ee · schema v1 · pii pii-v1
Full breach record for KerberRose →KerberRose S.C., a Wisconsin wealth management firm, notified the New Hampshire Attorney General of a data incident affecting 3 NH residents. An unauthorized third party gained access to an employee's email account on April 29, 2026, via phishing, accessing a backup platform. Data exposed included names, SSNs, financial account numbers, and DOBs. KerberRose isolated the system, engaged forensic investigators, and notified affected individuals on May 29, 2026, offering 24 months of credit monitoring.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_971065d86a026703Vermont State AGfiled 2026-05-29Verified
- bd_b053396543ca5b5eMaine State AGfiled 2026-05-29Verified
- bd_b5592268966c1f84Indiana State AGfiled 2026-05-29Verified
- bd_df731ff4766cb144Massachusetts State AGfiled 2026-05-01(28d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/kerberrose-20260529.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 29, 2026
- Raw hash
- 8eb2b2b68faa6c588b0792284e57ebc56fb90701ba6b6c2914c97ba05f5c813d
Reporting entity
- Name
- Godfrey & Kahn: GKLawnorm: godfrey kahn gklaw
- Domain
- gklaw.com
Victim entity
- Name
- KerberRosenorm: kerberrose
- Domain
- kerberrose.com
Incident
- Discovered
- May 1, 2026
- Materiality determined
- —
- Notification sent
- May 29, 2026
- Affected individuals
- 3
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified New Hampshire Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.