HackingStolen CredentialsBECSupply Chain (3P Vendor)Data ExfiltratedRansom DemandedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumActive
Rognan & Associates CPAs
bd_074538079ecb6e00 · schema v1 · pii pii-v1
Full breach record for Rognan & Associates CPAs →Rognan & Associates CPAs notified consumers of a data security event affecting client tax returns. On April 29, 2024, suspicious activity involving third-party tax preparation software was detected. Unauthorized actors edited direct deposit account information to misdirect refunds. Affected data included names, SSNs, DOBs, and bank details. The firm engaged forensic specialists, notified the IRS and law enforcement, and offered 12 months of credit monitoring.
Vermont clock✗ VT AG >45 bday10 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-07-09-rognan-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 9, 2024
- Raw hash
- c8c591b6dd408cabbe323a2b8776b4a4a2ebef0021a20475ba80e9cd2bb805fe
Reporting entity
- Name
- Rognan & Associates CPAsnorm: rognan associates cpas
Victim entity
- Name
- Rognan & Associates CPAsnorm: rognan associates cpas
Incident
- Discovered
- Apr 29, 2024
- Materiality determined
- —
- Notification sent
- Jul 9, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Contacted state tax boardsContacted IRSNotified federal law enforcement
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(71 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.