Merrimack Mortgage Company, LLC notified the NH Attorney General on September 2, 2016, of a phishing incident on August 3, 2016. Three employee email accounts were compromised via a spearphishing link, leading to credential theft. The company suspended accounts, reset passwords, enforced 2-Step Verification, and notified consumers. Credit watch protection was offered to affected borrowers. The exact scope of data accessed is unclear.