HackingProfessional ServicesFinancial ServicesProfessional ServicesStolen CredentialsBECSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedIdentity (basic)Government IDFinancial accountMediumActive

Rognan & Associates CPAs

bd_074538079ecb6e00 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2024

Filed

Jul 9, 2024

To disclose

10 weeks

Affected

Not disclosed

Confidence

67%

Full breach record for Rognan & Associates CPAs →

Rognan & Associates CPAs notified consumers of a data security event affecting client tax returns. On April 29, 2024, suspicious activity involving third-party tax preparation software was detected. Unauthorized actors edited direct deposit account information to misdirect refunds. Affected data included names, SSNs, DOBs, and bank details. The firm engaged forensic specialists, notified the IRS and law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday10 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 10 weeks / 71 days

Apr 29, 2024

Discovered

Jul 9, 2024

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Rognan & Associates CPAs
norm: rognan associates cpas

Name: Rognan & Associates CPAs
norm: rognan associates cpas
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: Apr 29, 2024
Materiality determined: —
Notification sent: Jul 9, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted state tax boardsContacted IRSNotified federal law enforcement
Initial access: supply_chain

During the incident: Contacted state tax boards and the IRS
Notified federal law enforcement
Partnered with cyber security specialists to conduct a thorough investigation
Offering a complimentary twelve (12) months of credit monitoring through Identity Defense by Epiq eDiscovery Solutions
Changes made: Reviewing existing policies and network security measures in place for ways to enhance the protection of data shared with our firm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(71 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-07-09-rognan-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 9, 2024
Raw hash: c8c591b6dd408cabbe323a2b8776b4a4a2ebef0021a20475ba80e9cd2bb805fe

Reporting entityRognan & Associates CPAs

Victim entityRognan & Associates CPAs

Incidentdiscovered Apr 29, 2024

Stated responseContacted state tax boards and the IRS

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov