HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Peabody & Arnold LLP

bd_12e7e84aa9f8081c · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 27, 2020

Filed

Dec 22, 2020

To disclose

30 weeks

Affected

97state residents only

Linked

5 filings

Confidence

66%

Full breach record for Peabody & Arnold LLP →

Peabody & Arnold LLP, a law firm, notified the New Hampshire Attorney General of a cybersecurity incident involving 97 state residents. An unauthorized party accessed an employee's email account between May 21 and May 27, 2020. The firm determined that emails containing names and Social Security numbers of NH residents were accessible. Notifications were mailed on December 21, 2020, offering one year of Experian credit monitoring. Remediation included enabling 2FA, resetting passwords, and disabling legacy email protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 30 weeks / 209 days

May 21, 2020

Begins

May 27, 2020

Discovered

Dec 22, 2020

Filed

vs. sector median

+11 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_857b22b660e99d4a2020-12-21 · +1dVerified
Maine State AGbd_aa415a9b27a3639c2020-12-21 · +1dCandidate
Maine State AGbd_bc8faef067c8a1902021-01-28 · +37dVerified
New Hampshire State AGbd_745a05f98594edf42021-01-29 · +38dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Peabody & Arnold LLP
norm: peabody arnold
Industry: Professional Servicesllm

Discovered: May 27, 2020
Breach occurred: May 21, 2020 – May 27, 2020
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 21, 2020
Affected individuals: 97state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the employee's email account
Launched an investigation to determine the nature and scope of the incident
Engaged a cybersecurity firm to assist in a full forensic analysis
Searched the contents of the account to identify individuals whose information may have been accessible
Mailed written notification via First-Class U.S. mail to the New Hampshire residents
Offered the New Hampshire residents a complimentary, one-year membership in credit monitoring and identity protection services through Experian
Established a dedicated phone number that individuals may call with related questions
Changes made: Enhanced its existing security protocols
Re-educated staff for awareness on these types of incidents
Enabled two-factor authentication on an enterprise-wide level
Reset passwords for all users in its email environment
Configured its email tenant to disable legacy email protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(209 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 21 · first

Maine State AGDec 21 · first

New Hampshire State AG+1d · this page

Maine State AG+38d

New Hampshire State AG+39d

Pattern: first filing Dec 21 (MA), last Jan 29 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/peabody-arnold-20201222.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2020
Raw hash: 3e04057dd3688f033d9c6ef3e5c6509194d374ebf09430369d2543dfdb85fb15

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityPeabody & Arnold LLP

Incidentdiscovered May 27, 2020

Stated responseSecured the employee's email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov