Incident · State breach notice (New Hampshire DOJ)
Service Lighting data breach: a card skimmer on its online store for six months
Compiled from public records. Updated 2026-11-15. By the cisonews.net Desk.
Service Lighting, a Maple Grove, Minnesota company, says it found on or about September 16, 2025 that its e-commerce website had been altered with malicious code that may have captured card data as shoppers typed it in at checkout. The cards at risk are those used in the online store from about March 12 to September 16, 2025, a window of six months. Name, card number, expiration date and CVV code were exposed. Letters began on March 4, 2026. New Hampshire was told of about 150 residents and Massachusetts lists 906, with card numbers marked.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
| Date | Event |
|---|---|
| About March 12, 2025 | First online store transaction in the affected window |
| About September 16, 2025 | Service Lighting finds the malicious code; end of the window |
| February 2, 2026 | Forensic investigation and document review identify the affected cards |
| March 4, 2026 | Letters; notice to New Hampshire (about 150 residents) |
| March 6, 2026 | Report to Massachusetts (906 residents) |
What happened at Service Lighting?
It was a web skimmer: code added to the store's pages that copied card details as they were entered. The company says the cards potentially accessed or taken relate to online store transactions between about March 12 and September 16, 2025. The notice does not say how the code got onto the site, or which store platform or plugin was involved.
The skimmer ran for about six months before it was found. For another checkout skimmer in this log, see Azure Standard. The payment card breach notice guide compares other card cases in this log.
Why did the letters take nearly six months?
The forensic work. Service Lighting says its investigation and document review found, on February 2, 2026, that the reader's card information may have been accessed or taken. Letters followed a month later. From the discovery on September 16, 2025 to the first letters on March 4, 2026 is 169 days. The notice letter delay guide puts that gap in context.
What information was exposed?
Full name with card number, expiration date and CVV code. No Social Security numbers or account logins are listed.
| Record | People | Data it marks |
|---|---|---|
| Massachusetts OCABR, report 2026-336 (March 6, 2026) | 906 | Card numbers |
| New Hampshire DOJ notice (March 4, 2026) | about 150 | Full name, card number, expiration date, CVV code |
What is Service Lighting offering?
The letter does not offer credit monitoring. It advises readers on fraud alerts, security freezes and free credit reports, and gives the contact details for the credit bureaus and the Federal Trade Commission. The credit monitoring guide shows what other notices offer.
Service Lighting says it is not aware of any reports of identity fraud or misuse caused by the incident.
What the documents leave open
- How the code got onto the website.
- The total number of cards and people affected across all states.
- Whether the card networks or issuers reported fraud tied to the store.
How this disclosure's timing compares
Service Lighting, Inc. disclosed 169 days after the discovery date its notice gives. Across the 232 other state breach notices on cisonews.net that date discovery to the day, the median gap is 101 days.
Other consumer & retail incidents on cisonews.net
- PCH Digital, LLC (Publishers Clearing House), Breach notice, first disclosed November 11, 2026
- Victoria's Secret & Co., Breach notice, first disclosed November 9, 2026
- Mavis Tire Supply LLC, Breach notice, first disclosed November 3, 2026
- Revolve Group, Breach notice, first disclosed October 29, 2026; 1,515,073 affected in total (Indiana Attorney General)
- Del Monte Foods, Breach notice, first disclosed October 29, 2026; affected: 11 Rhode Island residents
Sources
- 2026-03-04 · AService Lighting, Inc., notice to the New Hampshire Attorney General through counsel, with the sample letter, published March 4, 2026
- 2026-11-15 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report (checked November 15, 2026), published November 15, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.