HackingProfessional ServicesProfessional ServicesStolen CredentialsVulnerability ExploitData ExfiltratedCustomer Data InvolvedMulti-Stage ChainGovernment IDIdentity (basic)Financial accountFinancialPIIMediumContained

Kevin J Palmer & Co, CPA

bd_0346fcfb8345a62c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2017

Filed

Jul 20, 2017

To disclose

6 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Kevin J Palmer & Co, CPA →

Kevin J Palmer & Co, CPA experienced a cyberattack on its remote-access system used by outside IT personnel, occurring between May 21 and June 6, 2017. Attackers used stolen staff credentials to access tax filing software and exfiltrate personal information, including SSNs and financial data, to file fictitious federal tax returns. The firm engaged forensic investigators, notified the IRS and law enforcement, secured systems, and offered 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 6, 2017 → Notified Jun 22, 201716d ✓ CA 60-day OK6 weeks discovery → filing

Incident timeline

undetected · 16 days

discovery → filing · 6 weeks / 44 days

May 21, 2017

Begins

Jun 6, 2017

Discovered

Jul 20, 2017

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Kevin J Palmer & Co, CPA
norm: kevin j palmer co cpa

Name: Kevin J Palmer & Co, CPA
norm: kevin j palmer co cpa
Industry: Professional Servicesllm

Discovered: Jun 6, 2017
Breach occurred: May 21, 2017 – Jun 6, 2017
Undetected for: 16 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 22, 2017
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountFinancialPII
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue ServiceWorking with law enforcement
Initial access: external_remote_services

During the incident: Hired forensic team to conduct an investigation
Working with the Internal Revenue Service
Working with law enforcement to resolve the issue
Taken measures to secure our system and our workstations
Changed our Federal electronic filing credentials
Partnered with Equifax to provide Credit Watch Silver identity theft protection product for 12 months at no charge
Changes made: Taken measures to secure our system and our workstations
Changed our Federal electronic filing credentials
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: CA 60-day OK · 16d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 6, 2017
→ Notified: Jun 22, 2017
16d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 6, 2017 → Notified: Jun 22, 2017	16d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-100465
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2017
Raw hash: cae3d0b31e0906829704b2308fbcd9bf1771065f2c2d62c53f9c9c9d650d4ee1

Reporting entityKevin J Palmer & Co, CPA

Victim entityKevin J Palmer & Co, CPA

Incidentdiscovered Jun 6, 2017

Stated responseHired forensic team to conduct an investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov