MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)Health (basic)LowContained

Troutman Pepper Hamilton Sanders LLP

bd_23785f748b0bdd01 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 8, 2023

Filed

Dec 4, 2023

To disclose

43 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Troutman Pepper Hamilton Sanders LLP →

Troutman Pepper Hamilton Sanders LLP experienced a ransomware attack on February 8, 2023, resulting in unauthorized access and exfiltration of personal and protected health information. The firm detected the incident on the same day but determined the scope of compromised data in November 2023. Affected individuals are offered 12 months of credit monitoring and fraud assistance.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 8, 2023 → Notified Dec 4, 2023299d ✗ CA 60-day late43 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 43 weeks / 299 days

Feb 7, 2023

Begins

Feb 8, 2023

Discovered

Dec 4, 2023

Filed

vs. sector median

+25 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblack_bastabd_28a054e3a775be892023-03-23 · +255dCandidate

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_30048867f7068b2f2023-12-04Verified by operator
Vermont State AGbd_3f67dde8ca1ace852023-12-04Verified
Montana State AGbd_5d30fecba2fb58872023-12-04Verified by operator
New Hampshire State AGbd_278fc73071292b7e2023-12-15 · +11dVerified by operator

Name: Troutman Pepper Hamilton Sanders LLP
norm: troutman pepper hamilton sanders
Domain: troutman.com

Name: Troutman Pepper Hamilton Sanders LLP
norm: troutman pepper hamilton sanders
Domain: troutman.com
Industry: Professional Servicesllm

Discovered: Feb 8, 2023
Breach occurred: Feb 7, 2023 – Feb 8, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2023
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to law enforcement

During the incident: Immediately took steps to secure our network and mitigate against any additional harm
Reported the incident to law enforcement
Launched an investigation assisted by outside cybersecurity experts
Provided access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Provided proactive fraud assistance through Cyberscout through Identity Force
Changes made: Strengthened our network
Implemented additional security improvements recommended by third-party cyber security experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(299 days from discovery to filing)
Compliance flags: CA 60-day late · 299d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 8, 2023
→ Notified: Dec 4, 2023
299d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 8, 2023 → Notified: Dec 4, 2023	299d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGDec 4 · first

Vermont State AGDec 4 · first

Montana State AGDec 4 · first

California State AGDec 4 · first · this page

New Hampshire State AG+11d

Pattern: first filing Dec 4 (MA), last Dec 15 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-577407
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2023
Raw hash: 983fbac4cab4ee3b3bc6d135175c76f314e78a124d824f1446e251eb2b9fc2e5

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityTroutman Pepper Hamilton Sanders LLP

Victim entityTroutman Pepper Hamilton Sanders LLP

Incidentdiscovered Feb 8, 2023

Stated responseImmediately took steps to secure our network and mitigate against any additional harm

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov