Wilson, Elser, Moskowitz, Edelman & Dicker LLP

Henry County Hospital notified the NH Attorney General of a data security incident involving its third-party vendor, Aesto, LLC. Unauthorized access to Aesto's AWS infrastructure occurred between December 2 and December 18, 2025. HCH was notified on June 26, 2026. The incident potentially impacted 17 New Hampshire residents, exposing names, dates of birth, medical record numbers, and Social Security numbers. HCH offered 12 months of credit monitoring.

IMS Care Center, LLC reported unauthorized access to its email environment occurring between June 17-18, 2026, discovered on June 18, 2026. The incident potentially exposed name, address, Social Security numbers, and medical information for one New Hampshire resident. IMS engaged forensic investigators, implemented technical safeguards including Sophos MDR, and offered credit monitoring.

City of McMinnville notified the NH Attorney General of a data event where unauthorized access and copying of information occurred between June 1 and July 18, 2026. The incident was discovered on July 15, 2026. Ten New Hampshire residents were affected, with potential exposure of names, driver's license numbers, and Social Security numbers. The city engaged forensic investigators and offered 12 months of credit monitoring.

Blanchard Training and Development, Inc. experienced unauthorized access to its network environment between March 3 and March 4, 2026. The incident was discovered on March 4, 2026. An unauthorized individual may have copied information for 917 individuals, including 4 New Hampshire residents. Affected data included names, Social Security numbers, and/or financial account information. The company engaged forensic specialists, contained the incident, and provided credit monitoring services. This is a supplemental filing to the New Hampshire Attorney General.

Gateways Community Services, a nonprofit providing home and community-based services, experienced a cybersecurity incident involving phishing. On February 2, 2026, suspicious activity was discovered in an employee's email account. Forensic investigation revealed that email accounts were compromised via phishing between November 12, 2025, and January 21, 2026, resulting in unauthorized access to files containing personal information. Gateways notified 627 New Hampshire residents and an additional 134 Maine residents. Affected data included names, dates of birth, Medicaid IDs, financial information, and medical records. The organization secured the accounts, engaged forensic experts, and offered credit monitoring.

Westchester Ellenville Hospital (d.b.a. Ellenville Regional Hospital) notified the NH Attorney General of a data security incident involving its third-party vendor, Aesto, LLC. Unauthorized access to Aesto's AWS infrastructure occurred between December 2 and December 18, 2025. ERH was notified on June 26, 2026. The incident potentially affected 22 New Hampshire residents, exposing Social Security Numbers, dates of birth, and medical record numbers. ERH offered 12 months of credit monitoring and identity theft protection.

Graham County Hospital notified the NH Attorney General of a data security incident involving its third-party vendor, Aesto, LLC. Unauthorized access to patient data occurred between December 2 and December 18, 2025. GCH became aware of the incident on June 26, 2026. One New Hampshire resident was affected, with potential exposure of name, date of birth, and Social Security Number. GCH offered 12 months of credit monitoring.

Westchester Ellenville Hospital d.b.a. Ellenville Regional Hospital notified the MA AG of a data security incident involving third-party vendor Aesto, LLC. Unauthorized access occurred between Dec 2, 2025, and Dec 18, 2025, in Aesto's AWS environment. ERH was notified on June 26, 2026. 221 Massachusetts residents were affected. Data exposed included names, SSNs, dates of birth, medical record numbers, and physician names. ERH offered 24 months of credit monitoring.

About Women OB/Gyn, PC notified the NH Attorney General of a data event where an unauthorized individual viewed and copied information between December 1 and December 7, 2025. The incident was discovered on December 7, 2025. One New Hampshire resident was affected, with potential exposure of name, financial account numbers, financial access information, medical record numbers, and medical information. The company engaged forensic specialists, retained legal counsel, and offered credit monitoring services.

Upstaging, Inc. experienced unauthorized access to its network environment between May 28, 2026, and June 2, 2026. The company discovered unusual activity on June 2, 2026. An investigation revealed that certain information, including Social Security numbers, may have been copied by an unauthorized individual. One New Hampshire resident was affected. Upstaging engaged forensic specialists, retained legal counsel, and offered 12 months of complimentary credit monitoring and identity theft restoration services to affected individuals. Notification letters were mailed on August 5, 2026.

Heart of America Medical Center detected suspicious network activity on June 12, 2025, leading to unauthorized access by a third party. The incident potentially compromised personal information, including names, addresses, dates of birth, Social Security Numbers, and clinical/health insurance data. Two New Hampshire residents were affected. The organization isolated systems, engaged forensic investigators, and is offering credit monitoring.

New Hampshire Attorney General notice regarding a cybersecurity event at Little Bonanza, Inc. DBA Bonanza Casino. The company became aware of unauthorized access and file copying on February 21, 2026. One New Hampshire resident was affected, with Social Security numbers and driver's license information exposed. The company engaged forensic specialists, notified the FBI, and provided credit monitoring services. Notification letters were mailed on July 8, 2026.

Orthopaedic Specialists of Massachusetts (OSM) experienced unauthorized access to its network between January 12 and January 15, 2026. OSM became aware of suspicious activity on January 15, 2026. An investigation revealed that an unauthorized individual may have copied patient and employee information, including names, addresses, SSNs, and medical records. A total of 244 individuals were affected, including 46 New Hampshire residents and 244 Rhode Island residents. OSM offered 12 months of credit monitoring.

Taos Mountain Casino reported a cybersecurity incident discovered on March 28, 2026, involving unauthorized access to computer systems. The breach affected 3 Nebraska residents, exposing names, addresses, and Social Security numbers. TMC disconnected network access, engaged forensic investigators, reset credentials, and offered 12 months of credit monitoring via Kroll. Notifications were mailed on June 9, 2026.

Taos Mountain Casino detected suspicious activity on its computer systems on March 28, 2026. A forensic investigation found evidence that an unauthorized actor accessed some files. The incident potentially affected one New Hampshire resident, whose name, address, and Social Security number may have been accessed. The casino disconnected network access, engaged a third-party cybersecurity firm, changed credentials, and is offering 12 months of credit monitoring through Kroll.

Community Connections, a not-for-profit healthcare provider, notified the New Hampshire Attorney General of a cybersecurity incident discovered on March 20, 2026. Unauthorized access occurred from March 18-20, 2026, potentially exposing names, SSNs, DOBs, medical, and financial information of one NH resident. The company engaged forensic investigators, isolated systems, and offered 12 months of credit monitoring.

Ohio ENT & Allergy Physicians reported the loss or theft of a device containing patient information on March 29, 2026, discovered on March 30, 2026. The incident affected 324 individuals, including 1 Maine resident. The organization notified affected individuals in writing on May 29, 2026, and offered 12 months of credit monitoring and identity protection services.

Southern Illinois OB-GYN detected suspicious network activity on November 24, 2025, leading to a network interruption. A forensic investigation determined that an unauthorized third party potentially viewed or downloaded data, including names, SSNs, dates of birth, and health information. Six New Hampshire residents were affected. The organization isolated systems, engaged forensic experts, and is offering credit monitoring.

U.S. 1031 Exchange Services, Inc. reported a supplemental cybersecurity incident to the Maine Attorney General. An external breach occurred on October 6, 2025, discovered on October 16, 2025. The incident compromised names, addresses, SSNs, and bank account/routing numbers for approximately 2,090 individuals total, including 5 Maine residents. The company engaged forensic investigators, reset passwords, implemented MFA, and offered credit monitoring services.

Supplemental notice from U.S. 1031 Exchange Services, Inc. regarding a cybersecurity incident first discovered on October 16, 2025. Unauthorized access compromised names, addresses, SSNs, and bank account/routing numbers for 1,208 individuals, including 4 New Hampshire residents. Response included forensic investigation, password resets, MFA implementation, and 12 months of credit monitoring.

Gateways Community Services, a non-profit provider of home and community-based services, reported a cybersecurity incident discovered on February 2, 2026. The incident involved the compromise of an employee's email account via a phishing email, resulting in the exposure of Form W-2 data (including names, addresses, SSNs, and tax withholdings) for 689 individuals, including 15 Maine residents. Gateways engaged forensic investigators, secured the account, and notified affected individuals on May 5, 2026, offering credit monitoring services.

Charles River Insurance Brokerage, Inc. notified the NH AG of a cybersecurity incident discovered on Sept 19, 2025. Unauthorized access impacted employee data including names, SSNs, DOBs, and bank details. 197 individuals affected, 5 in NH. Notifications mailed April 27, 2026, with credit monitoring via Kroll.

U.S. 1031 Exchange Services, Inc. reported an external system breach (hacking) on October 6, 2025, discovered on October 16, 2025. The incident compromised names, addresses, SSNs, and bank account/routing numbers of 882 individuals. The company engaged forensic investigators, reset passwords, implemented MFA, and offered 12-24 months of credit monitoring. Notification was sent on April 23, 2026.

U.S. 1031 Exchange Services, Inc. reported a cybersecurity incident discovered on October 16, 2025, involving unauthorized access to files containing names, addresses, Social Security numbers, and bank account/routing numbers. 882 individuals were affected, including 2 Nebraska residents. The company engaged forensic investigators, shut down workstations, reset passwords, implemented MFA, and offered 12 months of credit monitoring. Notices were mailed on April 23, 2026.

Westwood Country Club detected suspicious network activity on October 17, 2024. An unauthorized actor accessed and copied files containing personal information. The incident affected 6 Maryland residents. Compromised data included names, Social Security numbers, driver's license numbers, financial account information, health insurance information, and medical information. The organization engaged a cybersecurity firm, secured its network, and offered 24 months of credit monitoring.