Social EngineeringPhishingData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumActive
Shapiro Tax Group LLP
bd_21e590057939eabf · schema v1 · pii pii-v1
Full breach record for Shapiro Tax Group LLP →Shapiro Tax Group LLP, a California-based tax services firm, disclosed a data breach affecting client Veronica M. Bonnelly. The incident, occurring on or about March 1, 2022, involved a compromised email account leading to the theft of personal information, including full name, Social Security number, residential address, and email address. The firm engaged technology consultants and law enforcement, implemented enhanced security measures (MFA, email authentication, EDR), and offered one year of credit monitoring services to the affected individual.
California clockDiscovered Jun 8, 2022 → Notified Jun 8, 20220d ✓ CA 60-day OK5 days discovery → filing
⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-554229
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 13, 2022
- Raw hash
- 4166f317773d0a9f2276efd2741c1f095ef8dce88e6263d9cda6bf42ff4b9ce1
Reporting entity
- Name
- Shapiro Tax Group LLPnorm: shapiro tax
- Domain
- shapirotaxgroup.com
Victim entity
- Name
- Shapiro Tax Group LLPnorm: shapiro tax
- Domain
- shapirotaxgroup.com
Incident
- Discovered
- Jun 8, 2022
- Materiality determined
- —
- Notification sent
- Jun 8, 2022
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing Link
- Threat actor
- External
- Regulator citations
- Notified the Attorney General of the breach
- Initial access
- phishing_link
Compliance
- Time to disclose
- 5 days(5 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 0d
- Discovery-date grounding
- notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 8, 2022→ Notified: Jun 8, 20220d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.