HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIMediumContained

New Jersey Society of Certified Public Accountants

bd_1fa704e043c62e11 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 17, 2025

Filed

Sep 3, 2025

To disclose

28 weeks

Affected · nationwide

2,5683 in this filing

Linked

4 filings

Confidence

66%

Full breach record for New Jersey Society of Certified Public Accountants →

New Jersey Society of Certified Public Accountants (NJCPA) reported a cybersecurity incident to the New Hampshire Attorney General. Unauthorized access occurred between February 11 and 17, 2025, involving an unauthorized party accessing the network. The incident affected 2,568 individuals nationwide, including 3 New Hampshire residents. Compromised data included PII. NJCPA engaged forensic investigators, reset credentials, notified law enforcement, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 28 weeks / 198 days

Feb 11, 2025

Begins

Feb 17, 2025

Discovered

Sep 3, 2025

Filed

vs. sector median

+10 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_605dba5d044c48c92025-09-03Verified
Massachusetts State AGbd_a21119f773bd86cf2025-09-03Verified
Maine State AGbd_ddba7b9b3a190f992025-09-03Candidate

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: New Jersey Society of Certified Public Accountants
norm: new jersey society of certified public accountants
Industry: Professional Servicesllm

Discovered: Feb 17, 2025
Breach occurred: Feb 11, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 3, 2025
Affected individuals: 2,568state + nationwide
Data types: PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Engaged a specialized third-party cybersecurity firm
Changed administrative credentials
Notified law enforcement
Continues to enhance its network security
Disconnecting all access to the network
Implementing an organization-wide credential reset of all users
Restructured and enhanced security systems
Upgrading our data management software
Providing twelve (12) months of complimentary credit monitoring and identity theft restoration services through Kroll
Changes made: Restructured and enhanced security systems
Upgrading our data management software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(198 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 3 · first

Massachusetts State AGSep 3 · first

Maine State AGSep 3 · first

New Hampshire State AGSep 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-jersey-society-certified-public-accountants-20250903.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 3, 2025
Raw hash: 8b42d6d2e3190a3dad3a6b1d96f3239cb0a4cf472d1017c0cfeba85ee7b30267

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityNew Jersey Society of Certified Public Accountants

Incidentdiscovered Feb 17, 2025

Stated responseEngaged a specialized third-party cybersecurity firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov