Nelson Mullins Riley & Scarborough LLP

They offered $8.000.000 to keep the data from being published.

Empowerment Schools - Healthcare Ltd and Texas Medical Careers, Limited (CHCP) notified the Maine AG of an external system breach (hacking) occurring between August 16-20, 2025. The incident was discovered on August 21, 2025. The breach affected 2 Maine residents, involving names and addresses. CHCP engaged forensic investigators, reset passwords, and offered 12 months of credit monitoring.

Ingo Money, Inc. reported an external system breach (hacking) on November 23, 2023, affecting 111 individuals, including 111 Maine residents. The incident involved the unauthorized removal of personal information (names and other identifiers) from a limited portion of its corporate network. Ingo Money engaged outside cyber professionals, notified law enforcement, and enhanced system security. Affected individuals were notified electronically on June 26, 2024, and offered 12 months of credit monitoring and identity protection services through Kroll.

Ingo Money, Inc. notified Washington AG of a data breach affecting 1,550 residents. Unauthorized access occurred on or about Nov 23, 2023, involving personal info (names, SSNs, driver's licenses, financial data). Notifications sent June 26, 2024. Law enforcement notified; credit monitoring offered.

Sunflower Bank, N.A. filed a supplemental data security incident notice with the New Hampshire Attorney General regarding a MOVEit zero-day vulnerability exploit. The bank notified 23 New Hampshire residents starting August 14, 2023. The incident involved unauthorized access via a third-party software vulnerability, resulting in the exfiltration of customer data. The bank is offering credit monitoring services to affected individuals.

University of the People reported a data breach affecting 11 Maine residents. The incident, which occurred between January 2, 2022, and January 10, 2022, was discovered on March 21, 2023. The breach was described as an external system breach (hacking) and resulted in the compromise of Social Security numbers. Affected individuals were notified in writing on March 24, 2023, and offered identity theft protection services.

CBD Industries, LLC notified Montana AG of a data privacy incident affecting 168 residents. Malicious code was inserted into the eCommerce platform between March 30 and May 18, 2020, risking the skim of customer PII and financial data. The company engaged forensic investigators, notified law enforcement, and offered one year of identity monitoring.

Goody Clancy and Associates, Inc., an architectural firm, notified the New Hampshire Attorney General of an unauthorized access to a company email account between June 30 and August 17, 2020. The incident affected two New Hampshire residents, exposing their names and Social Security numbers. Goody Clancy engaged TransUnion to provide two years of complimentary identity monitoring and implemented additional technical security measures. The investigation concluded that while unauthorized access occurred, there was no evidence of actual misuse of the personal information.

CDB Industries, LLC notified New Hampshire AG of a data privacy incident affecting 332 residents. Malicious code was added to its eCommerce platform between March 30 and May 18, 2020, risking customer PII and financial data. CDB engaged forensic investigators, notified law enforcement, and offered 1 year of identity monitoring.

CBD Industries, LLC notified NH AG of a data privacy incident where malicious code was added to its eCommerce platform, risking customer data (names, emails, billing addresses, credit/debit card numbers, bank account numbers) for orders placed between March 30 and May 18, 2020. 332 NH residents were at risk. The company engaged forensic investigators, notified law enforcement, and is offering one year of free identity monitoring.

CBD Industries, LLC, an online retailer, reported a cybersecurity incident where malicious code was added to its eCommerce platform, potentially skimming customer transaction data including names, emails, billing addresses, and credit/debit card numbers. The incident affected transactions between March 30, 2020, and May 18, 2020. The company notified law enforcement, offered one year of credit monitoring, and reported 1,088 affected individuals, including 48 Washington residents.

Santa Energy Corporation notified one New Hampshire resident of a ransomware incident. Files were encrypted June 16-22, 2020. No evidence of data access was found. The company engaged forensic investigators, restored backups, and provided 24 months of identity monitoring.

Kelly Financial Group (dba The Kelly Group) reported a business email compromise affecting 1 New Hampshire resident. Unauthorized access to an email account occurred May 11-13, 2020. Affected data included names and investment account numbers. The firm engaged forensic investigators and provided 24 months of identity monitoring.

Sealcoating Inc. d/b/a Indus notified NH AG of an email compromise affecting 23 NH residents. Unauthorized access occurred June 15–Sept 5, 2019, discovered Aug 26, 2019. Data included SSNs, driver's licenses, and financial accounts. Forensic investigation inconclusive; proactive notice and 12-month Equifax monitoring offered.

John Lucas Tree Expert Co. notified the NH Attorney General of a phishing incident where spoofed emails tricked individuals into making payments. An unauthorized user created a mail forwarding rule in an O365 account (Aug 2018–Jul 2019). 9 NH residents' SSNs or Driver's Licenses were potentially exposed. Forensic review found no evidence of access during a specific window, but proactive notice and 1-year Equifax monitoring were provided.

Care.com, Inc. notified the NH AG of an email account compromise discovered Jan 28, 2019. Unauthorized users accessed the account between Jan 26-28, 2019. Two NH residents affected; data included names and SSNs/gov IDs. Care.com engaged forensic firms, secured the account, and offered 1-year Equifax credit monitoring.

Custom Personalization Solutions, LLC notified the NH AG of a data breach affecting 37 NH residents. Unauthorized access to a database occurred between Jan 15 and Feb 9, 2018. Exposed data included names and encrypted payment card data. The company engaged cybersecurity experts, secured the data, and offered one year of Kroll identity monitoring to victims.

Crescent Mortgage Company notified the NH Attorney General of a data breach affecting 7 NH residents. Unauthorized access occurred July 14–Aug 5, 2017; discovered Aug 14, 2017. Data included names, SSNs, addresses, phone numbers, and financial account info. FBI notified; forensic experts engaged. Credit monitoring offered.

Barbecue Renew, Inc. notified the NH Attorney General of a data breach affecting 416 NH residents. Between Jan-Oct 2014, an SQL injection attack exposed cardholder data (names, addresses, card numbers, CVVs). Discovery occurred in Oct 2014 via bank fraud notifications. Response included forensic investigation, law enforcement notification, and 1 year of credit monitoring.

MemberClicks, Inc. (dba Moolah Payments) notified the NH AG of a data breach following the theft of an employee's company-issued laptop during an auto break-in on Oct 24, 2014. Discovered Oct 27, 2014, the incident affected <250 individuals (2 in NH). Compromised data included names, addresses, DOBs, and SSNs. Moolah engaged Kroll for credit monitoring and notified affected parties.

Horry Telephone Cooperative, Inc. notified the NH Attorney General of a security incident between Feb 1-3, 2012. Unauthorized attempts to transfer funds were made, and an intruder viewed automated payment records via a third-party vendor. Affected data included customer names, bank routing/account numbers, and HTC account numbers for 8 NH residents. No internal databases were accessed. HTC engaged law enforcement, notified banks, deployed antivirus updates, and implemented deep packet analysis middleware.

StudentCity.com, Inc. notified the NH Attorney General on July 1, 2011, of a data breach affecting 266 NH residents. Discovered June 9, 2011, the incident involved unauthorized access to a database containing names, credit card numbers, and passport numbers. Credit card encryption was broken in some cases. StudentCity engaged Verizon Business for forensics, notified the Secret Service, and offered ID Experts services.

Nashbar Direct, Inc. notified the New Hampshire Attorney General of a data breach affecting 1,307 state residents. Unauthorized access to previous website servers occurred starting in December 2008 and was confirmed on May 18, 2009. The incident exposed customer names, addresses, emails, passwords, and credit/debit card information. Nashbar took the site offline, migrated to a new host, engaged forensic experts, and notified payment networks and federal law enforcement.