MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedData ExfiltratedIdentity (basic)Government IDHealth (basic)PIIMediumContained

Davis, Hatley, Haffeman & Tighe, P.C.

bd_1e1852f16cc87b36 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 29, 2024

Filed

Jul 18, 2025

To disclose

—

Affected

5state residents only

Linked

4 filings

Confidence

67%

Full breach record for Davis, Hatley, Haffeman & Tighe, P.C. →

Davis, Hatley, Haffeman & Tighe, P.C. reported a ransomware incident to the Nebraska AG on July 18, 2025. The firm discovered unusual network activity on November 29, 2024, leading to a malicious encryption attack by unknown actors. Five Nebraska residents were notified, with impacted data including names, SSNs, driver's licenses, passport numbers, and medical/health insurance info. The firm engaged forensic experts, reported to the FBI, and provided credit/identity monitoring via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 29, 2024

Discovered

Jul 18, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_2f357cc042b862972025-07-18Candidate
Indiana State AGbd_c65b97bf7d5cce222025-07-18Verified
Massachusetts State AGbd_c7fe2f03f78b87842025-07-18Verified

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Davis, Hatley, Haffeman & Tighe, P.C.
norm: davis hatley haffeman tighe
Industry: Professional Servicesllm

Discovered: Nov 29, 2024
Materiality determined: —
Notification sent: Jul 18, 2025
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Nebraska Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure the network
Launched an investigation with the assistance of independent cybersecurity experts
Reported the incident to the FBI
Established a toll-free call center through TransUnion
Providing complimentary credit and identity protection services
Changes made: Implemented measures to enhance the security of its environment
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 18 · first

Indiana State AGJul 18 · first

Massachusetts State AGJul 18 · first

Nebraska State AGJul 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/c094b40c-571b-494f-82ad-fca99dbbdf8f.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2025
Raw hash: 273d9b7a772ba4d72f92c05a342fbfb0903f79e8741f5d553ff26cf082fa1487

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityDavis, Hatley, Haffeman & Tighe, P.C.

Incidentdiscovered Nov 29, 2024

Stated responseTook steps to secure the network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov