MalwareProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Creal & Creal

bd_1cb3cb41916a2845 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 8, 2020

Filed

Jan 8, 2021

To disclose

13 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Creal & Creal →

Creal & Creal, An Accountancy Corporation experienced a data breach involving malware that gained access to a server on September 10, 2020. The incident was discovered on October 8, 2020, when IRS e-file rejections were received. Compromised data included names, addresses, SSNs, bank account information, dates of birth, and driver's license numbers. The firm engaged forensic investigators, deleted the malware, implemented ESET anti-virus, and offered 24 months of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 28 days

discovery → filing · 13 weeks / 92 days

Sep 10, 2020

Begins

Oct 8, 2020

Discovered

Jan 8, 2021

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Creal & Creal
norm: creal creal

Name: Creal & Creal
norm: creal creal
Industry: Professional Servicesllm

Discovered: Oct 8, 2020
Breach occurred: Sep 10, 2020
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Date of birth
Attack vector: Unknown
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted the Internal Revenue Service

During the incident: Spent the next several weeks working with multiple IT forensic services to determine if our office was the source of the issue
Detected and immediately deleted a malware file
Implemented increased security measures, including a top-tier anti-virus software (ESET) on all of our workstations
Been in contact with the Internal Revenue Service
Changes made: Implemented increased security measures, including a top-tier anti-virus software (ESET) on all of our workstations
Offered 24 months of premium three-bureau identity monitoring through Norton LifeLock
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(92 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-198339
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 8, 2021
Raw hash: 938b1a60925e88fff5cdc006a1f564d7a8d23bc25571945f4f08095ef5fa2463

Reporting entityCreal & Creal

Victim entityCreal & Creal

Incidentdiscovered Oct 8, 2020

Stated responseSpent the next several weeks working with multiple IT forensic services to determine if our office was the source of the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov