CLARK HILL PLC

Maryville Academy, a HIPAA-covered entity in Iowa, notified the Iowa Attorney General of a data security incident discovered on July 15, 2024. Suspicious activity led to an investigation revealing unauthorized access to documents containing names, SSNs, DOBs, medical info, and financial account numbers. 15 Iowa residents were notified on August 31, 2026. Remediation included enhanced monitoring, password resets, and 12 months of credit monitoring via Cyberscout.

JRK Property Holdings, Inc. notified the Washington AG of a ransomware incident on March 26, 2026. The breach affected 5,667 Washington residents, exposing names, SSNs, driver's licenses, passport numbers, financial info, and health data. JRK engaged forensic experts, secured systems, and offered 12 months of credit monitoring.

JRK Property Holdings, Inc. filed a supplemental data breach notification with the Nebraska Attorney General on July 27, 2026. The incident involved unauthorized access to files containing personal information (names) of 1,032 Nebraska residents. Suspicious activity was first identified on March 26, 2026, and confirmed on June 28, 2026. JRK engaged cybersecurity experts, secured systems, and offered credit monitoring services.

YMCA of Southern Maine discovered suspicious network activity on May 5, 2026. An unauthorized individual gained access to systems, potentially accessing files containing names, addresses, Social Security numbers, and direct deposit information of employees and dependents. The incident was contained, and 22 New Hampshire residents were notified on July 14, 2026.

Alcott HR, a certified professional employer organization, notified the New Hampshire Attorney General of a data security incident. In February 2025, Alcott detected unauthorized activity on its network. An investigation concluded in March 2026 that an unauthorized user accessed systems containing personal information, including names, Social Security Numbers, and dates of birth, of 128 New Hampshire residents. Alcott engaged forensic experts, notified law enforcement, and implemented security enhancements including MFA and firewall strengthening. Identity theft protection services were offered to affected individuals.

Sprague and Jackson, a financial services firm, reported an external system breach (hacking) on September 22, 2025. The incident affected 6 Maine residents. Notification was sent electronically on May 26, 2026, offering 12 months of credit monitoring and identity protection via TransUnion.

D'Ambrosio Dodge notified the NH AG of a data security incident discovered on Nov 24, 2025. Unusual activity triggered an investigation by a third-party forensic firm. The incident potentially exposed names and addresses of 3 NH residents. Notifications were sent on May 5, 2026, offering 12 months of credit monitoring.

JRK Property Holdings, Inc. notified the New Hampshire Attorney General on May 11, 2026, of a data security incident affecting one New Hampshire resident. On March 26, 2026, unusual activity was detected, leading to an investigation that determined an unauthorized party accessed files containing names, addresses, SSNs, and bank account numbers. The company engaged forensic experts, secured systems, and provided one year of free credit monitoring via Experian to the affected individual.

D'Ambrosio Dodge Inc. reported an external system breach (hacking) on November 24, 2025, affecting 2 individuals, including 2 Maine residents. The incident involved unauthorized access to computer systems, resulting in the exposure of names, addresses, and variable data elements. The company engaged a third-party forensic firm, secured its systems, and offered IDX identity theft protection services to affected individuals.

JRK Property Holdings, Inc. reported a data security incident to the Nebraska Attorney General on May 5, 2026. Unauthorized access to systems containing personal information (names, SSNs, DOB, financial account numbers) was identified on March 26, 2026. One Nebraska resident was notified. JRK engaged forensic experts, secured systems, and offered 12 months of credit monitoring via Experian.

Pediatric Products, LLC reported a ransomware/cyberattack in Washington affecting 4,300 residents. Unauthorized access occurred Jan 27–Feb 4, 2026; discovered Feb 17, 2026. Data included names, DOBs, diagnosis codes, insurance info, and ID numbers. Response included engaging forensic experts, taking systems offline, and resetting passwords.

Sellers Publishing, Inc. reported an external system breach (hacking) on November 4, 2025, affecting 73 Maine residents. Personal information, including names and Social Security numbers, was potentially accessed. The company engaged forensic experts, isolated systems, and offered 12 months of credit monitoring. Notification was sent on March 10, 2026.

Copeland Chevrolet notified the NH AG that on August 4, 2025, suspicious activity was identified in an employee email account. The account was compromised, exposing customer names, SSNs, driver's license numbers, state IDs, and financial account information. Four NH residents were affected. Copeland secured the account, engaged forensic experts, implemented MFA, and offered 12 months of credit monitoring via Kroll.

Wettermark Keith LLC, a personal injury law firm, experienced unauthorized access to its internal computer system on April 14, 2025. The incident potentially exposed personal information for one New Hampshire resident, including name, SSN, driver's license, financial account numbers, and health insurance details. The firm contained the incident, engaged forensic investigators, and notified the affected individual on October 1, 2025.

Ancora Holdings Group, LLC notified the NH AG of a data security incident. On June 2, 2025, the company detected suspicious activity in an employee email account, likely due to phishing. An unauthorized individual accessed emails containing names, addresses, SSNs, and financial account info. 4 NH residents were notified on Sept 12, 2025. The company engaged forensic investigators, reset passwords, and offered credit monitoring.

Peregrine Property Management, LLC and Peregrine Group, LLC notified NH DOJ of a security incident discovered April 16, 2025. Unauthorized access to IT systems potentially exposed PII including names, DOB, SSN, driver's licenses, financial info, and health data. 5 NH residents affected. Notifications sent Sept 10, 2025. Forensic firm engaged; credit monitoring offered.

New American Funding, LLC notified the Washington AG of a ransomware incident involving third-party vendor Mobile Notary Zone (MNZ). Discovered June 6, 2025, the breach exposed consumer PII (SSNs, DOBs, financial accounts) for 1,991 WA residents. MNZ terminated; credit monitoring offered.

Southern Arkansas University Tech notified NH AG of a data security incident discovered in October 2024. An unauthorized user accessed systems and may have copied employee and student PII. One NH resident was notified on April 29, 2025. SAU Tech engaged forensic specialists, reset passwords, and deployed endpoint monitoring.

Southern Arkansas University Tech reported an external system breach (hacking) on October 30, 2024. One Maine resident was notified on April 29, 2025. The incident involved unauthorized access to systems and potential copying of personal information (names). The university engaged cybersecurity specialists, notified law enforcement, reset passwords, and deployed endpoint detection. Identity protection services were offered.

Southern Arkansas University Tech (SAU Tech) notified the Nebraska Attorney General of a data security incident discovered in October 2024. An unauthorized user gained access to SAU Tech's systems and may have copied files containing personal information, including names, SSNs, driver's license numbers, financial data, and limited health information. Seven Nebraska residents were affected. SA Tech engaged cybersecurity specialists, notified law enforcement, reset passwords, deployed endpoint monitoring, and offered 12 months of credit monitoring via IDX. Notification letters were sent on April 29, 2025.

CSG Consultants notified the Maryland AG of a data security incident in August 2024 where an unauthorized user accessed its network. The incident impacted personal information including names, addresses, dates of birth, and Social Security numbers. Two Maryland residents were notified. CSG engaged forensic experts, changed passwords, tightened endpoint monitoring, and offered 12 months of credit monitoring.

Miedema Produce, Inc. notified Maryland AG of a data security incident discovered Dec 19, 2024, affecting 4 Maryland residents. Suspicious activity led to investigation by forensic specialists. Impacted data included employee names, addresses, and SSNs. Response included password resets, enhanced monitoring, FBI cooperation, and 12 months of credit monitoring.

Professional Law Enforcement Association Inc. (PLEA) notified the Maryland Attorney General on March 10, 2025, of a data breach discovered on September 26, 2024. Unauthorized access to PLEA's systems exposed personal information of 108 Maryland residents, including names, SSNs, driver's licenses, financial account numbers, and medical/insurance data. PLEA engaged forensic experts, reset credentials, and provided 12 months of credit monitoring via TransUnion.

Colorado River Adventures reported a cybersecurity incident on Jan 21, 2025, involving malware/ransomware. Unauthorized access exposed names, DOBs, SSNs, and financial account numbers. 723 Washington residents notified on March 3, 2025. Law enforcement notified; IDX identity protection offered.

Bankers Cooperative Group, Inc. (BCG) notified the Maryland AG of a security incident affecting one Maryland resident. BCG identified suspicious activity on an employee email account on August 13, 2024, likely due to phishing. Impacted data included name, address, DOB, SSN, and health insurance info. BCG disabled the account, engaged forensic specialists, reset passwords, enabled MFA, and offered credit monitoring.