HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedData ExfiltratedPIILowContained

Bousquet Holstein PLLC

bd_1b3adac6ec3e11e0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 25, 2023

Filed

Apr 29, 2024

To disclose

31 weeks

Affected

1state residents only

Linked

6 filings

Confidence

64%

Full breach record for Bousquet Holstein PLLC →2 incidents on file

Bousquet Holstein PLLC notified Montana and other state regulators of a security incident discovered on September 25, 2023. An unauthorized actor accessed systems between Sept 25-27, 2023, likely acquiring files containing client PII. The firm engaged forensic specialists, notified law enforcement, and offered 12 months of credit monitoring. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 31 weeks / 217 days

Sep 25, 2023

Begins

Sep 25, 2023

Discovered

Apr 29, 2024

Filed

vs. sector median

+13 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_536837461e7f11de2024-04-29Verified
Vermont State AGbd_684950ca7aa003532024-04-29Verified
Maine State AGbd_c243ce49814f35642024-04-29Verified
Indiana State AGbd_e391a3f7a4d01e332024-04-29Verified

Show 1 more filing ↓

New Hampshire State AGbd_ef36e2c3e73bfdee2024-04-29Verified

Name: Bousquet Holstein PLLC
norm: bousquet holstein
Domain: bhlawpllc.com

Name: Bousquet Holstein PLLC
norm: bousquet holstein
Domain: bhlawpllc.com
Industry: Professional Servicesllm

Discovered: Sep 25, 2023
Breach occurred: Sep 25, 2023 – Sep 27, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2024
Affected individuals: 1state-resident count only
Data types: PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: promptly notified federal law enforcement

During the incident: Promptly notified federal law enforcement
Began a comprehensive investigation
With the assistance of external cybersecurity specialists
With the assistance of a third-party data analytics specialist
Conducted a thorough and time-consuming review of the files likely affected
Conducted a subsequent review to identify mailing addresses for notification
Providing notice of this incident to potentially impacted individuals and to regulators where required
Providing you with 12 months of complimentary access to credit monitoring and identity restoration services through Cyberscout
Changes made: Implemented additional security measures to mitigate risk associated with this incident and to help prevent similar future incidents
Continue to review and enhance our existing policies and procedures relating to data protection and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(217 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGApr 29 · first

Vermont State AGApr 29 · first

Maine State AGApr 29 · first

Indiana State AGApr 29 · first

New Hampshire State AGApr 29 · first

Montana State AGApr 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1321.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2024
Raw hash: c4a1f18c96ba53a7d30f181a3bec63c957648971628750f348400e625a6d7b7f

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBousquet Holstein PLLC

Victim entityBousquet Holstein PLLC

Incidentdiscovered Sep 25, 2023

Stated responsePromptly notified federal law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov