HackingTechnologyProfessional ServicesInformationStolen CredentialsCapture Stored DataData ExfiltratedTargetedIdentity (basic)Financial credentialsCredentialsLowContained

Fastcase, Inc. (Casemaker, LLC)

bd_06ba350257912138 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 28, 2021

Filed

Feb 26, 2021

To disclose

29 days

Affected

9state residents only

Confidence

65%

Full breach record for Fastcase, Inc. (Casemaker, LLC) →

Casemaker, LLC (a legal research platform provider) notified Montana AG that unauthorized access to its Libra platform occurred between July and October 2020. Attackers used malicious code to copy user data, including names, addresses, emails, passwords, and partial credit card numbers. Fastcase, which merged with Casemaker in Jan 2021, discovered the issue on Jan 28, 2021. The product was taken offline, forensic investigators were engaged, and users were prompted to change passwords.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 211 days

discovery → filing · 29 days

Jul 1, 2020

Begins

Jan 28, 2021

Discovered

Feb 26, 2021

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9 affectedView incident

Name: Fastcase, Inc. (Casemaker, LLC)
norm: fastcase inc casemaker

Name: Fastcase, Inc. (Casemaker, LLC)
norm: fastcase inc casemaker
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jan 28, 2021
Breach occurred: Jul 1, 2020 – Oct 31, 2020
Undetected for: 211 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 9state-resident count only
Data types: Identity (basic)Financial credentialsCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged a third-party forensic firm and outside counsel to investigate the matter
Took the Casemaker Libra product offline for security maintenance
Prompted password changes
Conducted a code review
Conducted security scans of the Casemaker platform
Installed security features on Casemaker platforms to help mitigate against malicious attacks in the future
Accelerated the migration of Casemaker Libra users to the Casemaker 4 platform as an interim security step
Changes made: Enhanced many security measures across our platforms
Installed security features on Casemaker platforms to help mitigate against malicious attacks in the future
Accelerated the migration of Casemaker Libra users to the Casemaker 4 platform as an interim security step
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/fastSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 26, 2021
Raw hash: 2f0e7aae0b68b5e27721e7d57d09a0b944e467e66ee79cf9022ede7b119a091a

Reporting entityFastcase, Inc. (Casemaker, LLC)

Victim entityFastcase, Inc. (Casemaker, LLC)

Incidentdiscovered Jan 28, 2021

Stated responseEngaged a third-party forensic firm and outside counsel to investigate the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov