Social EngineeringPhishingStolen CredentialsTargetedCustomer Data InvolvedDelayed DiscoveryIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
RF Associates, LLC
bd_1ab75f43c4df0c42 · schema v1 · pii pii-v1
Full breach record for RF Associates, LLC →RF Associates LLC, a CPA firm, notified the NH Attorney General of a data breach affecting 2 New Hampshire residents. An employee clicked a phishing link on or around Feb 20, 2025, leading to unauthorized access. The breach was discovered on Feb 25, 2025, when fraudulent tax filings were detected. Notifications were sent on Sept 5, 2025. Data included SSNs, government IDs, names, and bank info. Kroll provided identity monitoring.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_891853daca91d7afMontana State AGfiled 2025-09-19Candidate
- bd_ec6ffacb270b2b6fOregon State AGfiled 2025-09-25(6d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/rf-associates-20250919.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 19, 2025
- Raw hash
- 2d2156e847e25f950bffefde4072425f51d2c894d780aad7a517b18b5ec71508
Reporting entity
- Name
- RF Associates, LLCnorm: rf associates
Victim entity
- Name
- RF Associates, LLCnorm: rf associates
Incident
- Discovered
- Feb 25, 2025
- Materiality determined
- —
- Notification sent
- Sep 5, 2025
- Affected individuals
- 2
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the FBI, IRS, and Secret ServiceWorking with the appropriate agencies on behalf of clients
- Initial access
- phishing_link
Compliance
- Time to disclose
- 29 weeks(206 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.