HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
GOODWIN PROCTER LLP
bd_1a5ecb1ab228a867 · schema v1 · pii pii-v1
Full breach record for GOODWIN PROCTER LLP →Goodwin Procter LLP notified NH AG of a cybersecurity incident resulting from a third-party provider (Commvault) breach. Unauthorized access occurred April 29-May 1, 2025, using compromised credentials to access select email accounts. Personal information (name, SSN, DOB, passport) of 4 NH residents was exposed. Goodwin contained the incident, engaged forensic experts, notified law enforcement, and is offering 24 months of credit monitoring.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_b9c409173de26b15Vermont State AGfiled 2025-07-06(1d gap)Verified
- bd_55f8d93357aa2b37Maine State AGfiled 2025-07-02(5d gap)Candidate
- bd_713da412b4b3b670Indiana State AGfiled 2025-07-02(5d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/goodwin-procter-20250707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 7, 2025
- Raw hash
- d48a440a43a2c530564e94c5d9d99deaf8ba1520483d0dc1f72917af5921edf6
Reporting entity
- Name
- GOODWIN PROCTER LLPnorm: goodwin procter
- Domain
- goodwinlaw.com
Victim entity
- Name
- GOODWIN PROCTER LLPnorm: goodwin procter
- Domain
- goodwinlaw.com
Incident
- Discovered
- May 2, 2025
- Materiality determined
- Jun 6, 2025
- Notification sent
- Jul 2, 2025
- Affected individuals
- 4
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Office of the Attorney General, Consumer Protection Bureau
- Third party
- via Commvault
- Initial access
- supply_chain
Compliance
- Time to disclose
- 9 weeks(66 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.