HackingProfessional ServicesHealthcareProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDHealth (basic)PHIMediumContained

Easterseals UCP North Carolina & Virginia, Inc.

bd_20e5090eee758aca · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 28, 2024

Filed

Aug 21, 2025

To disclose

16 months

Affected

5state residents only

Confidence

66%

Full breach record for Easterseals UCP North Carolina & Virginia, Inc. →

Langdon & Co. CPA LLP, a third-party service provider to Easterseals UCP North Carolina & Virginia, Inc., reported unauthorized access to its network between April 21-28, 2024. The incident affected 5 New Hampshire residents, exposing names, SSNs, dates of birth, and medical/health insurance information. Langdon engaged forensic specialists, notified law enforcement, reset passwords, implemented MFA, and provided 12 months of identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 16 months / 480 days

Apr 21, 2024

Begins

Apr 28, 2024

Discovered

Aug 21, 2025

Filed

vs. sector median

+50 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Name: Langdon & Co. CPA LLP
norm: langdon & co cpa
Domain: nelsonandtownsend.com

Name: Easterseals UCP North Carolina & Virginia, Inc.
norm: easterseals ucp north carolina virginia
Industry: Professional ServicesllmHealthcarellm

Discovered: Apr 28, 2024
Breach occurred: Apr 21, 2024 – Apr 28, 2024
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2025
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire State Attorney General Consumer Protection & Antitrust Bureau
Initial access: valid_credentials

During the incident: Partnered with computer forensic specialists to investigate the nature and scope of the incident
Notified federal law enforcement
Reset all account passwords
Implemented multi-factor authentication
Offered twelve (12) months of identity theft monitoring and restoration services through IDX
Changes made: Updated our security measures following the incident
Working to update protections for any personal information we are required to store pursuant to applicable law
Destroying any information that we are no longer required to maintain
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 months(480 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/langdon-cpa-20250821.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2025
Raw hash: df1ef200233e3180658c3341d6e20cee1d3565372954e9d940667e9059f49422

Reporting entityLangdon & Co. CPA LLP

Victim entityEasterseals UCP North Carolina & Virginia, Inc.

Incidentdiscovered Apr 28, 2024

Stated responsePartnered with computer forensic specialists to investigate the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov