MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Abrams & Bayliss LLP

bd_22aa2660bc477bcd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 17, 2022

Filed

Jan 5, 2023

To disclose

—

Affected

Not disclosed

Confidence

66%

Full breach record for Abrams & Bayliss LLP →

Abrams & Bayliss LLP, a Delaware law firm, experienced a ransomware cyberattack on March 17, 2022. The incident impacted servers containing Protected Health Information (PHI) related to opioid litigation, including names, SSNs, dates of birth, and prescription details. The firm engaged forensic investigators, notified the FBI, and recovered systems from backups. Affected individuals are offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 42 weeks / 294 days

Mar 17, 2022

Discovered

Jan 5, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Abrams & Bayliss LLP
norm: abrams bayliss
Domain: abramsbayliss.com

Name: Abrams & Bayliss LLP
norm: abrams bayliss
Domain: abramsbayliss.com
Industry: Professional Servicesllm

Discovered: Mar 17, 2022
Materiality determined: —
Notification sent: Jan 5, 2023
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Notified the FBI

During the incident: Took measures to control the incident
Launched an investigation
Retained a prominent forensics firm and nationally recognized outside counsel to assist
Notified the FBI and cooperated with them
Fully recovered through our backup systems
Changes made: Adopted several new security measures to strengthen the security of A&B’s network, internal systems, and applications
Offering a complimentary two-year membership through IDX, a data breach and recovery services expert
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/01/AB-Breach-Notification-.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2023
Raw hash: 4b1fca7bd03616bf830844d8ee22b7492c890c94af41e39fbaf03b807e3f4bd2

Reporting entityAbrams & Bayliss LLP

Victim entityAbrams & Bayliss LLP

Incidentdiscovered Mar 17, 2022

Stated responseTook measures to control the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov