Lewis Brisbois Bisgaard & Smith, PLLC

On June 25, 2024, Hyper Ice, Inc. (Hyperice) was alerted by its endpoint detection and response solution to attempted encryption on one system. A forensic investigation determined certain files may have been exfiltrated. Data mining concluded December 3, 2024, identifying first name, last name, and Social Security numbers as impacted. 58 Maryland residents were notified December 12, 2024, and offered 12 months of credit monitoring through TransUnion. Hyperice implemented MFA and strengthened password requirements.

Goodwin University, Inc. (East Hartford, CT) reported an external system breach (hacking) to the Maine Attorney General. The breach occurred and was discovered on 12/04/2025, affecting 151 individuals total, all of whom were Maine residents. Written consumer notification was sent on 04/16/2026. The filing did not specify the categories of personal information acquired. The university offered 12 months of TransUnion credit monitoring and identity theft recovery services to affected individuals. The notification was submitted by outside counsel Erica Lloyd of Lewis Brisbois Bisgaard & Smith, PLLC.

IKAV Energy, Inc. notified the Maryland Attorney General of a data security incident occurring on December 6, 2024. Unauthorized actors acquired customer files containing names and Social Security numbers. IKAV engaged cybersecurity experts, secured the network, and notified 18 Maryland residents via mail on March 12, 2025.

United Domestic Workers of America, AFSCME Local 3930 notified the Maryland Attorney General of a data security incident occurring on or around January 17, 2025. An unauthorized third party attempted to gain access to the union's servers. The incident potentially exposed the name, address, and Social Security number of 2 Maryland residents. The union engaged forensic investigators, secured its network, and provided 12 months of credit monitoring and identity theft recovery services through TransUnion.

Inca Floats, Inc. (dba International Nature & Cultural Adventures) notified the Maryland AG of a November 2024 incident where an unauthorized third party attempted to infiltrate its network. 14 Maryland residents were potentially affected; names, DOB, and passport numbers may have been exposed. No exfiltration confirmed. Credit monitoring offered.

Applied Natural Gas Fuels, Inc. notified the New Hampshire Attorney General of a cybersecurity incident discovered on or around December 22, 2025. The incident potentially exposed personal information of one New Hampshire resident, including names, passport numbers, driver’s license numbers, and Social Security numbers. Notification was sent on February 26, 2026, offering 12 months of credit monitoring via Iris Identity Monitoring. The attack vector and specific initial access method remain unspecified.

Rockport Technology Group, Inc. notified the New Hampshire Attorney General of a December 18, 2025 security incident where an unauthorized third party attempted to infiltrate its network. The investigation concluded January 6, 2026, revealing potential exposure of names and Social Security numbers for 46 New Hampshire residents. RTG engaged forensic specialists, worked with law enforcement, and offered 12 months of credit monitoring via Cyberscout/TransUnion.

Blytheco, Inc. notified the New Hampshire Attorney General of a ransomware incident occurring on August 26, 2025. The attack resulted in the unauthorized acquisition of personal information (names) affecting 2 New Hampshire residents. Notifications were sent on December 3, 2025, offering credit monitoring. The FBI was notified and is cooperating with the investigation. Systems were wiped and rebuilt.

NFI North reported a cybersecurity incident to the New Hampshire Attorney General on November 13, 2025. An unauthorized third party accessed the network environment on or about September 6, 2025. The incident affected 72 New Hampshire residents, compromising names and Social Security numbers. NFI North engaged forensic specialists, notified the FBI, rebuilt systems, and provided 12 months of credit monitoring to affected individuals.

All American Poly Corp., a poly manufacturer in New Jersey, notified the Maryland Attorney General of a data security incident occurring on or around August 26, 2024. An unauthorized third party attempted to enter the network and exfiltrate data, potentially accessing names and Social Security numbers. One Maryland resident was notified on January 27, 2025. The company engaged forensic investigators, secured its network, and offered 12 months of credit monitoring and identity theft recovery services.

Workers Compensation Insurance Rating Bureau of California notified NH AG of a July 9, 2025 incident where an unauthorized entity accessed its Box.com account. One NH resident's personal info (name) was acquired. WCIRB engaged forensic specialists, secured the environment, and offered 12 months of credit monitoring. No evidence of misuse found.

United Domestic Workers of America, AFSCME Local 3930 notified the New Hampshire Attorney General of a security incident occurring on or around January 17, 2025. An unauthorized third party attempted to access servers, potentially exposing personal information (name, address, SSN) of 4 New Hampshire residents. The union engaged forensic investigators, secured its network, and mailed notification letters on August 8, 2025, offering 12 months of credit monitoring and identity theft recovery services through TransUnion/Cyberscout. The investigation was ongoing as of the filing date.

ITO EN (North America) INC. notified the Maryland Attorney General of a data security incident detected on December 2, 2024. An unauthorized third party attempted to enter the network and exfiltrate data. The incident affected 6 Maryland residents, exposing names, addresses, Social Security numbers, and financial account information. ITO EN engaged forensic investigators, secured its network, and offered 12 months of credit monitoring and identity theft protection services to affected individuals.

DePauw University notified the New Hampshire Attorney General of a cybersecurity incident occurring on October 31, 2023. An unauthorized third party infiltrated systems, potentially exposing personal information (names, SSNs, DOBs) for 10 NH residents. DePauw engaged forensic specialists, notified individuals on November 22, 2023, and offered credit monitoring. No evidence of misuse was found.

AlohaCare, a Hawaii-based health insurance provider, notified the New Hampshire Attorney General on November 3, 2023, of a data security incident involving the MOVEit file transfer tool vulnerability. The incident, discovered on or around May 31, 2023, impacted 12 New Hampshire residents. The breach exposed personal and protected health information. AlohaCare engaged third-party experts, notified credit bureaus, and offered complimentary credit monitoring and identity theft recovery services to affected individuals.

Country Doctor Community Health Clinic notified the NH AG of a Jan 6, 2022 incident where an unauthorized actor accessed systems containing PHI and PII (names, DOB, SSN, MRN) of 3 NH residents. Notifications sent Oct 14, 2022. No evidence of misuse. Remediation included technical security measures and 12 months credit monitoring.

Ryan Faenza Carey, P.C. notified the New Hampshire Attorney General on October 19, 2022, of a data security incident discovered on April 9, 2022. Unauthorized access to files containing Social Security numbers and financial account numbers affected approximately 9 New Hampshire residents. The firm retained forensic experts, reported to the FBI, and provided credit monitoring services to affected individuals.

Alternative Investment Resource, LLC (AIR Asset Management) notified the New Hampshire Attorney General of a data security incident affecting 3 NH residents. Unauthorized access to two employee email accounts occurred between Jan 22 and Mar 28, 2022. AIR discovered the activity on March 28, 2022, and notified residents on Oct 13, 2022. Affected data included names, addresses, DOB, SSNs, and government IDs. AIR engaged cybersecurity experts, secured the email environment, and offered credit monitoring services.

Valle del Sol, Inc., a non-profit healthcare services organization, notified the New Hampshire Attorney General of a data security incident detected on January 25, 2022. The incident involved unauthorized access to patient records containing names, Social Security numbers, and driver's license numbers. Seven New Hampshire residents were affected. Valle del Sol engaged forensic investigators, reported the incident to the FBI, and provided credit monitoring services to affected individuals.

Physician’s Business Office, Inc. (PBO) notified the New Hampshire Attorney General of a data security incident discovered in April 2022. The breach potentially affected 4 New Hampshire residents, exposing personal and protected health information including SSNs, driver's license numbers, and medical data. PBO engaged forensic investigators, secured its network, and offered 12 months of credit monitoring to affected individuals. Notifications were sent in September 2022.

Centerstone of Tennessee, Inc. notified the New Hampshire Attorney General of a data security incident involving one NH resident. Unauthorized access to an employee email account occurred on January 8, 2022, likely via phishing. The breach exposed names and Social Security numbers. Centerstone discovered the activity on February 14, 2022, and notified the resident on September 12, 2022. Remediation included credential resets, policy revisions, and offering 12 months of credit monitoring.

Cultural Experiences Abroad, LLC, an education organization, reported an external system breach (hacking) that occurred on May 13, 2022, and was discovered on August 15, 2022. The breach affected 442 individuals, compromising their names and Social Security numbers. In response, the company provided written notification to those affected on September 13, 2022, and offered 12 months of complimentary identity theft protection services through IDX.

Ian Martin PBC notified the New Hampshire Attorney General of a data security incident occurring between March 15 and March 22, 2022. The breach involved unauthorized access to an internal file server, potentially exposing names and Social Security numbers of two New Hampshire residents. Ian Martin engaged forensic investigators, reported the incident to the FBI, and provided complimentary identity protection services through Kroll to affected individuals.

Gerber Technology, LLC reported a data security incident to the New Hampshire Attorney General on May 25, 2022. The company discovered unauthorized access to its systems on February 16, 2022. The incident potentially exposed personal information of 32 New Hampshire residents, including names, Social Security numbers, driver's license information, passport numbers, and bank account information. Gerber engaged forensic experts, notified the FBI, and provided 24 months of complimentary identity monitoring services through Kroll to affected individuals.

Val Verde Regional Medical Center (VVRMC) notified the New Hampshire Attorney General of a data security incident occurring on March 10, 2022. The breach affected approximately 8 New Hampshire residents, exposing names, SSNs, dates of birth, and medical/insurance information. VVRMC engaged forensic experts, secured its network, and notified the FBI. Affected individuals received notification letters on May 24, 2022, offering 12 months of complimentary identity monitoring through Kroll.