Wilson, Elser, Moskowitz, Edelman & Dicker LLP

New Hampshire Attorney General notice regarding a cybersecurity event at Little Bonanza, Inc. DBA Bonanza Casino. The company became aware of unauthorized access and file copying on February 21, 2026. One New Hampshire resident was affected, with Social Security numbers and driver's license information exposed. The company engaged forensic specialists, notified the FBI, and provided credit monitoring services. Notification letters were mailed on July 8, 2026.

Orthopaedic Specialists of Massachusetts (OSM) notified the New Hampshire Attorney General of a data event involving unauthorized access to patient and employee records. The incident occurred between January 12, 2026, and January 15, 2026, affecting 46 New Hampshire residents. Exposed data included names, addresses, SSNs, dates of birth, and medical/insurance information. OSM engaged forensic investigators, offered 12 months of credit monitoring, and mailed notification letters on June 12, 2026.

Taos Mountain Casino notified the New Hampshire Attorney General of a cybersecurity incident discovered on March 28, 2026. Unauthorized access to computer systems resulted in the potential compromise of one New Hampshire resident's name, address, and Social Security number. The casino disconnected network access, engaged forensic investigators, reset credentials, and offered 12 months of credit monitoring via Kroll.

Community Connections, a not-for-profit healthcare provider, notified the New Hampshire Attorney General of a cybersecurity incident discovered on March 20, 2026. Unauthorized access occurred from March 18-20, 2026, potentially exposing names, SSNs, DOBs, medical, and financial information of one NH resident. The company engaged forensic investigators, isolated systems, and offered 12 months of credit monitoring.

Ohio ENT & Allergy Physicians reported the loss or theft of a device containing patient information on March 29, 2026, discovered on March 30, 2026. The incident affected 324 individuals, including 1 Maine resident. The organization notified affected individuals in writing on May 29, 2026, and offered 12 months of credit monitoring and identity protection services.

Southern Illinois OB-GYN notified the New Hampshire Attorney General on May 19, 2026, of a cybersecurity incident discovered on November 24, 2025. An unauthorized third party potentially viewed or downloaded patient data, including names, SSNs, DOBs, and health information, affecting 6 NH residents. The company isolated systems, engaged forensic investigators, and offered 12 months of credit monitoring.

U.S. 1031 Exchange Services, Inc. (Sarasota, FL), a qualified intermediary for like-kind exchanges, reported to the Maine Attorney General that an external system breach (hacking) occurred on October 6, 2025 and was discovered on October 16, 2025. A total of 2,090 persons were affected, including 5 Maine residents. Written notification was sent on May 8, 2026, and 12 to 24 months of identity theft protection services were offered. The notice did not specify the categories of personal information acquired.

Supplemental notice from U.S. 1031 Exchange Services, Inc. regarding a cybersecurity incident first discovered on October 16, 2025. Unauthorized access compromised names, addresses, SSNs, and bank account/routing numbers for 1,208 individuals, including 4 New Hampshire residents. Response included forensic investigation, password resets, MFA implementation, and 12 months of credit monitoring.

Gateways Community Services, a non-profit based in Nashua, NH, filed a Maine AG data breach notice reporting a cyber incident occurring and discovered on 2/2/2026, affecting 689 individuals total (15 Maine residents). The breach description was reported as 'Other' and the specific data elements compromised were not enumerated in this filing. Written notifications were sent on 5/5/2026, and 12-24 months of TransUnion identity theft protection services were offered. The notice letter (ME_AG_Notice_of_Cyber_Incident_-_Gateways.pdf) was referenced but its content not included in this extraction.

Charles River Insurance Brokerage, Inc. notified the NH AG of a cybersecurity incident discovered on Sept 19, 2025. Unauthorized access impacted employee data including names, SSNs, DOBs, and bank details. 197 individuals affected, 5 in NH. Notifications mailed April 27, 2026, with credit monitoring via Kroll.

U.S. 1031 Exchange Services, Inc. (Sarasota, FL) reported to the Maine AG a data breach described as an 'External system breach (hacking).' The incident occurred on 10/06/2025 and was discovered on 10/16/2025. A total of 882 persons were affected, including 2 Maine residents. Written notifications were sent on 4/23/2026. Identity theft protection (TransUnion, 12-24 months) was offered. The Maine notice does not specify the data elements compromised.

Westwood Country Club, located in St. Louis, MO, notified the Maryland Attorney General of a cybersecurity event discovered on October 17, 2024. An unauthorized actor accessed and copied files containing names, Social Security numbers, driver's license numbers, financial account information, and medical data. Six Maryland residents were affected. Notifications were mailed on March 24, 2025, offering 24 months of credit monitoring.

Ahmuty Demers & McManus (ADM), a law firm, notified the Maryland Attorney General of a cybersecurity event discovered on February 26, 2025. An unauthorized actor viewed and copied data, impacting one Maryland resident. Compromised data included names and Social Security numbers. ADM engaged a third-party cybersecurity firm, conducted a data review completed March 11, 2025, and offered 12-24 months of credit monitoring. Notification letters began mailing on March 27, 2025.

Eliza Jennings Senior Care Network reported a cybersecurity incident discovered on March 5, 2025, involving unauthorized access to its network. The breach potentially exposed names, Social Security numbers, and financial account numbers for 4,012 individuals, including one Maryland resident. The company engaged forensic specialists, notified law enforcement, and mailed notification letters on March 31, 2025, offering credit monitoring services.

Laurel Eye Clinic notified the New Hampshire Attorney General of a cybersecurity incident discovered on January 26, 2025. An unauthorized user obtained certain files containing names, financial account numbers, and routing numbers. Four New Hampshire residents were identified and notified on April 22, 2026. The clinic engaged forensic investigators, disconnected network access, and offered 12 months of credit monitoring.

Auto Auction of New England Inc. reported an external system breach (hacking) to the Maine Attorney General. The incident occurred on 02/10/2026 and was discovered on 04/15/2026. Written notice was sent on 04/22/2026 to 17 Maine residents; total affected count not disclosed in the filing. The data categories acquired were not specified in the form. Affected individuals were offered 12 months of proactive fraud assistance through Cyberscout/TransUnion.

Microforum Services Group notified the New Hampshire Attorney General of a data event occurring between December 18 and 22, 2025, discovered on December 22, 2025. The incident involved unauthorized copying of customer name, contact, and credit card information. One New Hampshire resident was affected. Microforum engaged forensic specialists, retained counsel, and provided 24 months of credit monitoring via TransUnion. Notification letters were mailed on April 21, 2026.

Maine AG data breach notice filed by counsel (Wilson Elser) on behalf of Buena Vista Management Services, LLC dba Windward Life Care, a San Diego-based home care provider. The filing reports an external system breach (hacking) that occurred on 12/8/2025 and was discovered on 4/6/2026. One Maine resident was affected; the total persons affected was not stated. Written consumer notifications were sent on 4/10/2026, and 12 months of TransUnion fraud monitoring was offered. The categories of information acquired were not enumerated in this notice.

Blanchard Training & Development, Inc. reported an external system breach (hacking) to the Maine AG. Breach occurred on March 3, 2026 and was discovered April 3, 2026. Only 1 Maine resident was affected; total persons affected was not disclosed in this filing (shown as '-'). Written consumer notification sent April 8, 2026. 12 months of TransUnion credit monitoring offered. The 'Information Acquired' field was blank in the filing, so specific data types affected cannot be confirmed from the source.

New Hampshire Historical Society notified the NH Attorney General of a data event discovered on February 13, 2026. Unauthorized access resulted in the copying of names and Social Security numbers for 63 NH residents. The Society engaged forensic investigators and legal counsel, mailed notifications on April 1, 2026, and offered 12 months of credit monitoring via TransUnion/Cyberscout.

Kerkering, Barberio & Co., a CPA firm, notified the NH AG of a cybersecurity incident discovered May 27, 2025, involving unauthorized access to four email accounts. The breach exposed PII including SSNs, DOBs, driver's licenses, and financial data for 4 NH residents. KB engaged forensic investigators, isolated accounts, and offered 12 months of credit monitoring.

OCAT LLC d/b/a Evoke Wellness at Hilliard, a medical health provider in Ohio, notified the New Hampshire Attorney General of a data incident discovered on August 7, 2025. Unauthorized access to patient information may have occurred, potentially exposing names, addresses, DOB, SSNs, driver's licenses, and credit card data. One New Hampshire resident was identified and notified on February 27, 2026. OCAT offered 12 months of credit monitoring via Cyberscout/TransUnion. The incident status is contained.

Susquehanna Glass Company reported a cybersecurity event to the New Hampshire Attorney General. Unauthorized access occurred between Dec 1-2, 2025, resulting in the copying of one NH resident's name, DOB, and SSN. The company retained forensic specialists, offered 12 months of credit monitoring, and mailed notifications on Feb 26, 2026.

Miz Mooz, Inc. notified the New Hampshire Attorney General of a data event involving unusual activity in its website environment. The incident occurred between January 25 and January 28, 2026, and was discovered on January 28, 2026. One New Hampshire resident was affected, with name and credit card information potentially compromised. Miz Mooz engaged legal counsel, offered 12 months of credit monitoring via TransUnion, and mailed notification letters on February 26, 2026.

Couve Healthcare Consulting, LLC DBA Evergreen Healthcare Group (EHG) notified the New Hampshire Attorney General of a cybersecurity incident discovered on December 3, 2025, involving unauthorized access to its cloud-based healthcare platform. One New Hampshire resident was affected, with compromised data including Social Security Numbers, medical information, and names. EHG engaged forensic investigators, isolated systems, and offered 12 months of credit monitoring.