LATHAM & WATKINS LLP

Flash Charm, Inc. d/b/a Idera reported an external system breach (hacking) on a third-party file-hosting system. The incident, detected on October 31, 2025, and discovered on February 20, 2026, affected the personal information (names, contact info) of 2,015 individuals, including 2 Maine residents. Idera notified law enforcement, engaged forensic investigators, and provided 24 months of credit monitoring and identity protection services to affected individuals.

Flash Charm Inc. (dba Idera) notified the NH Attorney General of a breach involving its Egnyte file hosting platform. Unauthorized access occurred on October 31, 2025, affecting 7 NH residents. Data exposed included names, contact info, SSNs, bank account numbers, and health insurance info. Contained Nov 8, 2025. Notifications sent Feb 26, 2026, offering 2 years credit monitoring.

Summit Hotel Properties, Inc. notified the New Hampshire Attorney General of a security incident on November 21, 2025. The breach, discovered on October 5, 2025, involved an external threat actor exfiltrating documents from corporate servers. One New Hampshire resident was affected, with their name, contact info, and SSN exposed. The incident was contained on October 6, 2025, and the victim was offered 24 months of credit monitoring via Kroll.

Coinbase Inc. notified the New Hampshire Attorney General of an insider threat incident where overseas support employees improperly accessed customer account information. A third party claimed to have obtained this data and demanded a $20 million ransom, which Coinbase refused. Approximately 454 New Hampshire residents were potentially impacted. Coinbase suspended the employees, notified customers, and is offering credit monitoring.

MD Now Medical Centers, Inc. notified the NH AG of a cybersecurity attack on a legacy IT system discovered May 20, 2024. Unauthorized access occurred in early May 2024, resulting in the exfiltration of patient discharge/prescription forms and HR records. Approximately 103 New Hampshire residents were affected. MD Now retained forensic experts, notified law enforcement, and is offering credit monitoring.

San Antonio Shoemakers, Inc. notified the Washington AG of a malware attack on checkout systems from April 21 to June 13, 2016, affecting payment card data. Discovered June 8, 2016. 511 Washington residents affected. Notified July 18, 2016. Identity monitoring provided.

Care.com, Inc. notified the NH Attorney General that on March 3, 2016, it became aware that 2015 payroll data for 39 New Hampshire residents was acquired by an unauthorized party via a phishing attack. The compromised data included names, addresses, Social Security numbers, and salary/tax information. Care.com offered 24 months of identity monitoring and credit freeze reimbursement.

US Airways notified the NH Attorney General that unauthorized intruders accessed a small number of Dividend Miles accounts using stolen usernames and passwords. Affected data included names, addresses, emails, security questions, DOB, and partial credit card digits. US Airways reset passwords, engaged forensic investigators, and provided credit monitoring.

Trion Worlds, Inc. notified the NH AG that unauthorized intruders accessed an account database. Approximately 3.3 million accounts were affected, including 4,731 in NH. Data included usernames, encrypted passwords, DOB, email, billing address, and credit card info (full numbers encrypted by processor). Notification to NH residents was scheduled for Dec 22, 2011.

Latham & Watkins LLP reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2011-05-20. 2 Massachusetts residents were affected. The report records the breach type as paper.