Polsinelli PC

Monmouth University notified the NH Attorney General of a supplemental data breach affecting 586 New Hampshire residents. An unauthorized third party accessed the network between Feb 5-13, 2026, and exfiltrated files containing names, dates of birth, and Social Security numbers. The university discovered the incident on March 3, 2026. This notice supplements a June 30, 2026 initial notice, adding 369 previously unidentified residents. Credit monitoring is offered.

The Moody Bible Institute of Chicago reported a data security incident affecting 447 New Hampshire residents. On June 12, 2026, the organization identified suspicious activity and determined an unauthorized third party acquired files due to a zero-day software vulnerability. The compromised data included names, dates of birth, Social Security numbers, driver's license numbers, and financial aid information. The data was encrypted or specialized, requiring specific software to view. Moody patched the vulnerability, engaged forensic investigators, notified law enforcement, and offered one year of complimentary credit monitoring through Kroll.

SunSource Borrower LLC notified the NH Attorney General that an unknown third party accessed its network between March 31 and April 5, 2026, acquiring files containing personal information of 30 New Hampshire residents. Affected data included names, dates of birth, health insurance information, medical information, and Social Security or tax identification numbers. The company engaged forensic experts, contained the incident, and is offering credit monitoring.

Mariner Wealth Advisors, LLC reported a security incident to the New Hampshire Attorney General on June 1, 2026. A criminal third party impersonated MWA IT help desk agents via a spoofed domain to phish credentials from three associates starting November 21, 2025. The incident affected 35 New Hampshire residents, exposing names, account numbers, dates of birth, and SSNs/government IDs. The accounts were isolated, law enforcement was notified, and victims were offered 12 months of credit monitoring.

Sierra Pacific Mortgage notified the Maryland Attorney General that an unauthorized party accessed two employee email accounts between October 2-8, 2024. Review of the email contents identified names and Social Security numbers of six Maryland residents. The company engaged a forensic security firm, is providing one year of Experian credit monitoring, and is enhancing technical and administrative safeguards. No evidence of misuse reported.

Drummond Company, Inc. reported an external system breach (hacking) on Feb 20, 2026, discovered Feb 23, 2026. An unauthorized third party accessed an employee email account containing names, SSNs, DOBs, and medical info. 1,398 individuals affected (1 in Maine). Notification sent March 31, 2026, offering 12 months of credit monitoring.

TABB INC. notified the Iowa AG that a database containing background check data was publicly discoverable on August 14, 2024. One Iowa resident's name, SSN, and driver's license number were potentially exposed. TABB secured the database and offered 12 months of credit monitoring.

HCF of Sweden Valley Inc. reported a data breach affecting 2 Maryland residents. An unauthorized third party accessed the management company's computer systems starting September 17, 2024. The incident involved personal information including names, SSNs, DOBs, financial account numbers, and medical/insurance data. Notifications were mailed on January 9, 2025, offering credit monitoring. The incident was discovered on October 3, 2024.

HCF of Edinboro Inc. (Edinboro Manor) reported a data breach affecting 2 Maryland residents. Unauthorized access occurred on September 17, 2024, via the management company's computer systems. Personal information exposed included names, DOB, SSN, financial account numbers, and medical/insurance data. Notifications were mailed on January 9, 2025, offering credit monitoring. The incident is contained.

Promontory Investments LLC reported an unauthorized access to its network occurring between Nov 11-13, 2024, discovered Nov 13, 2024. 12 Maryland residents' names, DOB, contact info, and SSNs were accessed. Promontory contained the breach, engaged forensic investigators, notified law enforcement, and mailed notices on Jan 14, 2025, offering credit monitoring.

Encompass Care Inc. reported a cybersecurity incident to the Maryland Attorney General involving one Maryland resident. An unauthorized third party gained access to a management company's computer systems between September 17, 2024, and October 3, 2024. The accessed documents contained personal information including names, dates of birth, Social Security numbers, financial account numbers, and medical/insurance information. Encompass Care engaged forensic investigators, notified law enforcement, and offered credit monitoring services to the affected individual.

HCF of Warren Inc. (Warren Manor) reported a cybersecurity incident to the Maryland Attorney General on January 10, 2025. An unauthorized third party gained access to the management company's computer systems starting September 17, 2024. The incident affected 2 Maryland residents, exposing names, dates of birth, Social Security numbers, financial account numbers, and medical/insurance information. Warren Manor engaged forensic investigators, notified law enforcement, and offered credit monitoring services.

HCF of Washington Inc. (operating as Court House Manor) reported a cybersecurity incident to the Maryland Attorney General on January 10, 2025. An unauthorized third party gained access to the management company's computer systems starting September 17, 2024. The incident affected one Maryland resident, exposing personal information including name, date of birth, Social Security number, financial account number, and medical/insurance information. The victim was notified on January 9, 2025, and offered credit monitoring services.

Sedgebrook OpCo SL VII LLC reported a ransomware incident to New Hampshire AG on Oct 23, 2025. Unauthorized access occurred May 4-5, 2025. One NH resident's PII (SSN, DOB, medical/insurance info) was accessed. Sedgebrook engaged forensic investigators, notified law enforcement, and offered credit monitoring.

ECON Heating & Air Conditioning experienced an external system breach (hacking) between February 21 and 24, 2025, discovered on July 24, 2025. The incident affected 1,408 individuals, including 1 Maine resident. Notification was sent on September 12, 2025, offering 12 months of identity theft protection via TransUnion CyberScout.

James H Cunningham Insurance Agency Inc. reported a cybersecurity incident to the New Hampshire Attorney General on August 25, 2025. The breach involved unauthorized access to the network between September 6 and 13, 2024, discovered on September 10, 2024, via a phishing email. The incident affected 16 New Hampshire residents, exposing names, DOBs, SSNs, financial account numbers, and health information. The agency engaged forensic investigators and law enforcement, and offered 12 months of credit monitoring.

Alpha Baking Co., Inc. reported an external system breach (hacking) occurring on January 22, 2025, discovered on May 22, 2025. The incident affected 21,463 individuals, including 1 Maine resident. Personal information, including names and government identifiers, was accessed. The company engaged forensic experts and is offering one year of credit monitoring and identity theft restoration services.

Forum Communications Company notified the Maryland AG of a data breach affecting 12 residents. Unauthorized access occurred Jan 14-31, 2025, exposing names, DOBs, and SSNs. Forensic investigation confirmed the scope. Affected individuals received notification letters and 12 months of credit monitoring. Forum is reviewing technical security measures.

Numotion, a provider of seating and mobility products, disclosed a supplemental breach affecting 22,854 Washington residents. Unauthorized access to employee email accounts occurred between September 2 and November 18, 2024. The incident exposed names, DOBs, medical/insurance info, SSNs, and driver's licenses. Numotion secured accounts, engaged forensic investigators, and offered credit monitoring.

Promontory Investments LLC dba The Promontory Club reported an external system breach (hacking) occurring between Nov 11-13, 2024, discovered Dec 16, 2024. 1,562 individuals affected, including 1 Maine resident. Data involved names, contact info, DOB, and SSNs. The company engaged forensic investigators, enhanced security measures, and offered 1 year of Experian IdentityWorks credit monitoring.

HCF Management, Inc. reported an external system breach (hacking) occurring on September 17, 2024, discovered on October 3, 2024. The incident affected 225 individuals, including 2 Maine residents. Compromised data included names, SSNs, DOBs, financial account numbers, and medical information. The company engaged forensic investigators, notified law enforcement, and offered 12 months of Experian IdentityWorks credit monitoring. Notification was sent on January 9, 2025.

HCF of Fairview, Inc. reported a data breach where an unauthorized third party accessed systems on September 17, 2024. The incident was discovered on October 3, 2024. Affected data included names, SSNs, DOBs, financial account numbers, and medical information. 3,866 individuals were affected, including 1 Maine resident. Notifications were sent on January 9, 2025, offering 12 months of credit monitoring.

Doxim, Inc. reported a security incident where files containing personal information (names, SSNs, account numbers) were removed from its network between Dec 25-30, 2023. Doxim, a third-party service provider for credit unions, notified 302 New Hampshire residents by October 2024. The investigation is closed, and no misuse has been found.

Mystic Valley Elder Services reported an external system breach on April 5, 2024, affecting 87,236 individuals, including 39 in Maine. The incident involved unauthorized access to systems containing names and PHI. The company engaged forensic investigators, notified law enforcement, and offered 12 months of credit monitoring via Experian.

OnePoint Patient Care disclosed a ransomware incident affecting 34,394 Washington residents. Unauthorized access occurred between August 3-8, 2024. Data included names, addresses, SSNs, medical records, and diagnoses. Notices began mailing October 23, 2024.