HackingProfessional ServicesProfessional ServicesStolen CredentialsCapture Stored DataCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Hulberg & Associates

bd_05338464dd3fd5b8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 11, 2025

Filed

Aug 19, 2025

To disclose

6 weeks

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Hulberg & Associates →

Hulberg and Associates, Inc., a real estate appraisal firm, notified the Washington AG of a July 11, 2025 server breach affecting one resident. Unauthorized access to HR files exposed employee PII including SSNs, driver's licenses, and bank account numbers. The company engaged forensic investigators, isolated the server, reset passwords, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 39 days

Jul 11, 2025

Begins

Jul 11, 2025

Discovered

Aug 19, 2025

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

A leak claim by play about this victim predates this filing by 48 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteplaybd_0473e25a75eb84fc2025-07-02 · +48dVerified

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_49b16929ceef7b012025-08-20 · +1dVerified by operator

Name: Sparks Group
norm: sparks group
Domain: sparksgroupinc.com

Name: Hulberg & Associates
norm: hulberg associates
Domain: hulberg.com
Industry: Professional Servicesllm

Discovered: Jul 11, 2025
Breach occurred: Jul 11, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 19, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified Washington Attorney General

During the incident: Commenced its incident response to isolate and contain the threat, including disconnecting the affected server from the network
Engaged a cybersecurity firm to conduct a forensic investigation into the incident
Offering impacted individuals twelve (12) months of free credit and identity monitoring services, including identity restoration services through Experian IdentityWorks
Changes made: Changing all passwords
Installing upgraded endpoint detection sensors on computers
Using a managed detection and response service, which is monitored 24/7 by a third-party security operations service, to monitor, detect and respond immediately to any threats to the company’s network security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: WA AG >30dLeak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Washington State AGAug 19 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA34402.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 19, 2025
Raw hash: 94c1689fd1b592cb71467f04a66c6a247769486ad4b537de54a6f4e83307e560

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entitySparks Group

Victim entityHulberg & Associates

Incidentdiscovered Jul 11, 2025

Stated responseCommenced its incident response to isolate and contain the threat, including disconnecting the affected server from the network

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com