Lewis Brisbois Bisgaard & Smith, PLLC

NFI North detected unauthorized third-party access to its network on September 6, 2025. A forensic investigation concluded on July 6, 2026, that personal information and protected health information may have been accessed. 2,813 New Hampshire residents were affected. NFI North engaged forensic specialists, wiped and rebuilt affected systems, notified the FBI, and is offering credit monitoring.

Hyper Ice, Inc. experienced a ransomware incident on June 25, 2024, involving attempted encryption and unauthorized acquisition of files. The breach affected 58 Maryland residents, exposing first name, last name, and Social Security numbers. The company contained the incident, engaged forensic investigators, and notified law enforcement. Credit monitoring was offered to affected individuals.

IKAV Energy, Inc., a renewable assets management company, experienced a network disruption on December 6, 2024. An investigation determined that certain files may have been acquired without authorization. A review concluded on February 13, 2025, that some customers' personal information, including names and Social Security numbers, was present in the impacted data set. Eighteen Maryland residents were notified via mail on March 12, 2025.

United Domestic Workers of America, AFSCME Local 3930 detected an unauthorized access attempt on its servers on or around January 17, 2025. The incident potentially exposed the name, address, and Social Security numbers of two Maryland residents. The organization secured its network, engaged forensic investigators, and offered 12 months of credit monitoring and identity theft recovery services to affected individuals.

Inca Floats, Inc. (dba Integrity Galapagos) detected an unauthorized third-party attempt to infiltrate its network on November 24, 2024. The company patched servers, deactivated accounts, and launched an investigation. While no data exfiltration was confirmed, 12 Maryland residents were notified out of caution due to potential exposure of names, addresses, dates of birth, and passport numbers. This is a supplemental notification regarding travel partner-affiliated individuals.

Applied Natural Gas Fuels, Inc. notified the New Hampshire Attorney General of a cybersecurity incident discovered on or around December 22, 2025. The incident potentially exposed personal information of one New Hampshire resident, including names, passport numbers, driver’s license numbers, and Social Security numbers. Notification was sent on February 26, 2026, offering 12 months of credit monitoring via Iris Identity Monitoring. The attack vector and specific initial access method remain unspecified.

Rockport Technology Group, Inc. reported an external system breach (hacking) occurring Dec 18-19, 2025, discovered Jan 6, 2026. 91 individuals affected, including 1 Maine resident. Personal info (name, SSN) potentially exposed. Forensic firm engaged; credit monitoring offered.

Rockport Technology Group, Inc. notified the New Hampshire Attorney General of a December 18, 2025 security incident where an unauthorized third party attempted to infiltrate its network. The investigation concluded January 6, 2026, revealing potential exposure of names and Social Security numbers for 46 New Hampshire residents. RTG engaged forensic specialists, worked with law enforcement, and offered 12 months of credit monitoring via Cyberscout/TransUnion.

Blytheco, Inc. experienced a ransomware attack on August 26, 2025, resulting in the unauthorized acquisition of personal information for 2 New Hampshire residents. The compromised data included names and Social Security numbers. The company engaged forensic specialists, wiped and rebuilt affected systems, notified the FBI, and offered credit monitoring services.

Blytheco, Inc. reported an external system breach (hacking) on August 21, 2025, discovered on August 26, 2025. The incident affected 476 individuals, including 1 Maine resident. First and last names were accessed. The company engaged forensic specialists, rebuilt systems, and notified the FBI. Affected individuals received notification on November 7, 2025, and were offered 12 months of credit monitoring.

Cool Wind Ventilation Corp. reported an external system breach (hacking) on August 26, 2025, discovered on August 29, 2025. The incident affected 1,404 individuals nationwide, including 1 Maine resident. Compromised data included names, SSNs, driver's license numbers, and bank account/routing numbers. The company engaged forensic specialists, notified the FBI, rebuilt affected systems, and provided 12 months of credit monitoring services to affected individuals.

Donelan's Supermarkets, Inc. reported an external system breach (hacking) occurring on August 14, 2025, discovered on October 31, 2025. The incident affected 1,096 individuals nationwide, including 2 Maine residents. First and last names were accessed. The company engaged forensic specialists, rebuilt affected systems, notified the FBI, and provided 12 months of credit monitoring via Kroll.

NFI North detected a network security incident on September 6, 2025, where an unauthorized third party accessed its network environment. The investigation determined that personal information, including names and Social Security numbers, was acquired. 72 New Hampshire residents were affected. NFI North engaged forensic specialists, wiped and rebuilt affected systems, notified the FBI, and offered credit monitoring.

North American Family Institute, Inc. (NFI North) reported an external system breach (hacking) occurring on September 1, 2025, detected on September 6, 2025. The incident affected 131 individuals, including 49 Maine residents. Exfiltrated data included names and Social Security numbers. NFI North engaged forensic specialists, rebuilt affected systems, notified the FBI, and provided 12 months of credit monitoring and fraud assistance to affected individuals.

All American Poly Corp., a poly manufacturer, detected unauthorized third-party access to its network on August 26, 2024. The actor attempted to exfiltrate data. The investigation concluded on December 5, 2024. One Maryland resident was affected, with potential exposure of name and Social Security number. The company secured its network, engaged forensic investigators, and offered 12 months of identity protection services.

Workers Compensation Insurance Rating Bureau of California notified NH AG of a July 9, 2025 incident where an unauthorized entity accessed its Box.com account. One NH resident's personal info (name) was acquired. WCIRB engaged forensic specialists, secured the environment, and offered 12 months of credit monitoring. No evidence of misuse found.

Franklin Dermatology Group, PLC reported a third-party data breach involving billing vendor Nationwide Recovery Services (NRS). Unauthorized access occurred July 5-11, 2024. Patient data including names, SSNs, DOBs, PHI, and financial info was compromised. 2,457 individuals affected. Notification sent Sept 11, 2025. Credit monitoring offered.

United Domestic Workers of America, AFSCME Local 3930 detected an unauthorized access attempt on its servers on January 17, 2025. An investigation determined that personal information (name, address, SSN) for 4 New Hampshire residents was potentially impacted. The organization secured its network, engaged forensic investigators, and offered 12 months of credit monitoring. The investigation is ongoing.

ITO EN (North America) INC. detected unauthorized access and attempted data exfiltration on December 2, 2024. The incident potentially exposed names, mailing addresses, Social Security numbers, and bank account information of 6 Maryland residents. The company secured its network, engaged forensic investigators, and offered 12 months of identity protection services.

Inca Floats, Inc. (dba International Nature & Cultural Adventures) reported an external system breach on November 24, 2024, affecting 873 individuals, including 7 Maine residents. The incident may have exposed names, addresses, dates of birth, and passport numbers. The company secured its network, conducted a forensic investigation, and offered 12 months of credit monitoring and identity theft protection services.

OrthopedicsNY, LLP, an orthopedic practice in New York, disclosed a ransomware incident affecting 5,397 individuals, including 1 Maine resident. The breach occurred on December 28, 2023, when an unauthorized third party infiltrated the network and demanded ransom. The investigation concluded on December 5, 2024, revealing potential exposure of names, SSNs, and ITINs. Notices were sent on December 13, 2024, offering 12 months of credit monitoring.

Cardiology Associates of Mobile, Inc., a cardiovascular physician group, reported an external system breach (hacking) occurring between Oct 18-22, 2024. Discovered Nov 7, 2024, the incident potentially exposed names, DOBs, driver's licenses, passports, and SSNs of 1,514 individuals. The company engaged forensic investigators, secured its network, and offered 12 months of credit monitoring.

J.S. McCarthy Co., Inc. reported a cybersecurity incident detected on October 20, 2024, involving unauthorized access to files containing personal information of approximately 4 New Hampshire residents. The company engaged forensic experts, notified the FBI, and mailed notifications on November 8, 2024, offering credit monitoring.

Lewis Brisbois reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-09-30. 45 Massachusetts residents were affected.