Morrison & Foerster LLP

Morrison Foerster is a leading international law firm with a presence in the United States, Asia, and ...

OpenLoop Health Inc. reported unauthorized access to systems on Jan 7-8, 2026, affecting ~19,980 Washington residents. Data included names, DOB, contact info, and treatment details. No SSN or financial data. OpenLoop engaged forensic experts, coordinated with federal law enforcement, terminated access, and began notifying residents on Mar 17, 2026, offering credit monitoring.

Boyd Gaming Corporation reported a cyber incident to the New Hampshire Attorney General. Unauthorized access occurred Sept 5-7, 2025, resulting in the exfiltration of personal information (names, addresses, DOB, driver's license, SSN) of 40 NH residents. Boyd discovered the incident on Sept 6, 2025, and notified affected individuals on Sept 24, 2025. Remediation included password resets and enhanced security controls.

Boyd Gaming Corporation notified the Iowa AG of a cyber incident where unauthorized actors accessed systems between Sept 5-7, 2025. The breach exposed Iowa residents' PII including names, SSNs, and driver's license info. Boyd discovered the incident on Sept 6, 2025, and notified ~4,000 Iowa residents on Sept 24, 2025. Response included engaging forensic experts, resetting passwords, and offering 2 years of credit monitoring.

EMPIRE Distribution Inc. notified the NH Attorney General of a cyber incident affecting 3 NH residents. Unauthorized access to internal systems occurred between Nov 2024 and July 7, 2025. Data involved: names, SSNs, bank account numbers. EMPIRE engaged forensic experts, notified federal law enforcement, terminated access, and offered 24 months of credit monitoring via IDX.

Johnson Controls filed a supplemental security breach notification with the Iowa Attorney General on June 30, 2025, regarding 2,259 Iowa residents. The incident occurred between February 1, 2023, and September 30, 2023, when an unauthorized actor accessed systems and exfiltrated employee/contractor personal information. Johnson Controls discovered the breach on September 24, 2023, and has since enhanced security controls, reset passwords, and offered credit monitoring.

Johnson Controls filed a supplemental breach notification with the Washington AG on June 30, 2025, covering 4,903 residents. Unauthorized access occurred Feb 1–Sep 30, 2023. Johnson Controls discovered the incident on Sep 24, 2023. Data involved employee/contractor PII, including names and potentially credentials. Remediation included password resets, MFA expansion, and enhanced monitoring. 2-year credit monitoring offered.

Unanet, Inc. reported a cybersecurity incident where an unauthorized third party gained access to a limited portion of its internal network via anomalous activity in a third-party support tool. The incident affected approximately 962 individuals, including 5 Maine residents. Personal information accessed included names, addresses, SSNs, emails, phone numbers, DOBs, and employment data. Unanet engaged cybersecurity experts, notified law enforcement, and provided 24 months of identity monitoring through Kroll.

Snap-on, Inc. reported an external system breach (hacking) occurring on March 3, 2022, discovered on March 7, 2022. The incident affected 41,052 individuals, including 320 Maine residents. Acquired data included names and driver's license numbers. Snap-on notified consumers on April 7, 2022, and provided 24 months of credit monitoring and identity theft protection services through IDX.