HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountMediumContained

Scott R. Bell, CPA, PLLC

bd_01ce85cfa36277bf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 8, 2020

Filed

Nov 23, 2020

To disclose

11 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Scott R. Bell, CPA, PLLC →

Scott R. Bell, CPA, PLLC notified the New Hampshire Attorney General of a data event affecting one NH resident. Unauthorized access to the firm's tax filing application occurred between April 26-28, 2020. The firm discovered the breach on September 8, 2020, after IRS rejected tax returns. Data exposed included names, SSNs, DOBs, and financial account info. The firm engaged forensic specialists, notified the FBI and IRS, and provided 12 months of credit monitoring via Experian to the affected individual.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 135 days

discovery → filing · 11 weeks / 76 days

Apr 26, 2020

Begins

Sep 8, 2020

Discovered

Nov 23, 2020

Filed

vs. sector median

6 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_b3bd3df5f7cc43112020-11-19 · +4dVerified
Massachusetts State AGbd_be34b4eaa7ddbe562020-11-19 · +4dVerified
Montana State AGbd_cfc7930a81576b972020-11-19 · +4dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Scott R. Bell, CPA, PLLC
norm: scott r bell cpa
Industry: Professional Servicesllm

Discovered: Sep 8, 2020
Breach occurred: Apr 26, 2020 – Apr 28, 2020
Undetected for: 135 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 18, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Federal Bureau of InvestigationNotified the Internal Revenue ServiceNotified relevant state regulators
Initial access: valid_credentials

During the incident: Initiated investigation with the assistance of third-party forensic specialists
Reviewed information stored in the tax application
Provided written notice to all affected individuals
Provided access to credit monitoring services for at least twelve (12) months, through Experian
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Notified the Federal Bureau of Investigation
Notified the Internal Revenue Service
Notified relevant state regulators
Changes made: Working to implement additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(76 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGNov 19 · first

Massachusetts State AGNov 19 · first

Montana State AGNov 19 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/scott-r-bell-20201123.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 23, 2020
Raw hash: 918783f5971cb6e518ae068b198d21781315baf6478eb4853e34a101c9683703

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityScott R. Bell, CPA, PLLC

Incidentdiscovered Sep 8, 2020

Stated responseInitiated investigation with the assistance of third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov