HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedIdentity (basic)LowContained

Brown & Streza, LLP

bd_0663a08426d27125 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 18, 2023

Filed

May 12, 2023

To disclose

16 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

67%

Full breach record for Brown & Streza, LLP →

Brown & Streza, LLP notified consumers of a data security incident where an unknown actor gained unauthorized access to their network. The firm detected unusual activity on January 18, 2023, and launched a forensic investigation. The incident potentially involved names and other personal information. The firm engaged cybersecurity experts, secured the network, reported to law enforcement, and is offering 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday16 weeks discovery → filing

Incident timeline

discovery → filing · 16 weeks / 114 days

Jan 18, 2023

Discovered

May 12, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelosttrustbd_f929cda0efe9b7eb2023-09-26 · +137dVerified by operator

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_57809da712dfd9f22023-05-12Verified by operator
Indiana State AGbd_80bcc587bca48cf82023-05-12Verified by operator
Montana State AGbd_9cf9bf5bf5fe645c2023-05-12Verified by operator
California State AGbd_a3fdea8d506e32402023-05-12Verified by operator

Show 3 more filings ↓up to 224d gap

Massachusetts State AGbd_006b1d203b6c9d072023-12-22 · +224dVerified
California State AGbd_4007dc1bfdd337302023-12-22 · +224dVerified
Montana State AGbd_807d8fea0e6122fd2023-12-22 · +224dCandidate

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com
Industry: Professional Servicesllm

Discovered: Jan 18, 2023
Materiality determined: —
Notification sent: May 12, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the incident to law enforcement

During the incident: Took immediate steps to ensure our network was secure
Launched a forensic investigation with the assistance of independent cybersecurity experts
Reported the incident to law enforcement
Implemented additional security measures to reduce the risk of future incidents
Offering 12 months of complimentary identity protection services through Experian IdentityWorks
Changes made: Implemented additional security measures to reduce the risk of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(114 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Massachusetts State AGMay 12 · first

Indiana State AGMay 12 · first

Montana State AGMay 12 · first

California State AGMay 12 · first

Vermont State AGMay 12 · first · this page

Massachusetts State AG+224d

California State AG+224d

Montana State AG+224d

Pattern: first filing May 12 (MA), last Dec 22 (MT) — a 224-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-05-12-brown-streza-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2023
Raw hash: 77fda757add5b932b6deaad9e1e429b18a0f3102a9fca46dc77e772b5f13ecb2

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityBrown & Streza, LLP

Victim entityBrown & Streza, LLP

Incidentdiscovered Jan 18, 2023

Stated responseTook immediate steps to ensure our network was secure

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov