Social EngineeringProfessional ServicesProfessional ServicesPhishingData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Facey Goss & McPhee P.C.

bd_1be50d0075c5a41f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 14, 2024

Filed

Mar 19, 2024

To disclose

5 weeks

Affected

71state residents only

Linked

5 filings

Confidence

66%

Full breach record for Facey Goss & McPhee P.C. →

Facey Goss & McPhee P.C. notified the New Hampshire Attorney General of a phishing incident affecting approximately 71 NH residents. An unauthorized individual accessed an employee email account between Sept 28 and Oct 4, 2023. The firm discovered the breach on Feb 14, 2024, after forensic review. Personal information, including SSNs, was accessed. The firm provided credit monitoring and advised residents on fraud alerts.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 139 days

discovery → filing · 5 weeks / 34 days

Sep 28, 2023

Begins

Feb 14, 2024

Discovered

Mar 19, 2024

Filed

vs. sector median

14 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_5b1dab218d9c4a2d2024-03-15 · +4dCandidate
Massachusetts State AGbd_82741c7af3f834702024-03-15 · +4dVerified
Maine State AGbd_f6ae6291be671c502024-03-15 · +4dVerified by operator
Vermont State AGbd_f7d3a745d12141da2024-03-15 · +4dVerified

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Facey Goss & McPhee P.C.
norm: facey goss mcphee
Industry: Professional Servicesllm

Discovered: Feb 14, 2024
Breach occurred: Sep 28, 2023 – Oct 4, 2023
Undetected for: 139 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2024
Affected individuals: 71state-resident count only
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General John Formella
Initial access: phishing_link

During the incident: Began efforts to remediate the incident and commenced a prompt and thorough investigation
Working closely with external cyber security professionals
Extensive forensic investigation and manual document review
Providing complimentary credit monitoring to the affected residents with impacted Social Security numbers
Advising the affected residents to always remain vigilant in reviewing financial account statements
Advising the affected residents about the process for placing a fraud alert and/or security freeze on their credit files
Providing contact information for the consumer reporting agencies and the Federal Trade Commission
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGMar 15 · first

Massachusetts State AGMar 15 · first

Maine State AGMar 15 · first

Vermont State AGMar 15 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/facey-goss-mcphee-20240319.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 19, 2024
Raw hash: b868b907d2266df606667be85dc7410b91227a406127549e8016f78fc3349233

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityFacey Goss & McPhee P.C.

Incidentdiscovered Feb 14, 2024

Stated responseBegan efforts to remediate the incident and commenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov