MalwareTechnologyProfessional ServicesInformationRansomwareCapture Stored DataData ExfiltratedData EncryptedCustomer Data InvolvedAuthenticationCredentialsIdentity (basic)MediumContained

Casemaker, LLC and Lawriter, LLC

bd_23c0234980274fce · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2021

Filed

Feb 27, 2021

To disclose

4 weeks

Affected

1,690state residents only

Linked

2 filings

Confidence

67%

Full breach record for Casemaker, LLC and Lawriter, LLC →

Casemaker, LLC and Lawriter, LLC experienced a cybersecurity incident where attackers used malicious code to access user tables on the Casemaker Libra platform. Unauthorized access occurred between July and October 2020. The incident was discovered on January 28, 2021. Affected data included names, addresses, emails, and passwords. 1,690 Washington residents were notified.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 211 days

discovery → filing · 4 weeks / 30 days

Jul 1, 2020

Begins

Jan 28, 2021

Discovered

Feb 27, 2021

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_b0990178dfe0ad602021-02-26 · +1dVerified

Name: Faegre Drinker Biddle & Reath LLP
norm: faegre drinker biddle reath

Name: Casemaker, LLC and Lawriter, LLC
norm: casemaker llc and lawriter
Industry: TechnologyllmProfessional Servicesllm

Discovered: Jan 28, 2021
Breach occurred: Jul 1, 2020 – Oct 31, 2020
Undetected for: 211 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 26, 2021
Affected individuals: 1,690state-resident count only
Data types: AuthenticationCredentialsIdentity (basic)
Data elements: NameUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Bob Ferguson pursuant to Washington Statute § RCW 19.255.010

During the incident: Engaged a third-party forensic firm and outside counsel to investigate the matter
Took the Casemaker Libra product offline for security maintenance
Prompted password changes
Conducted a code review
Conducted security scans of the Casemaker platform
Installed security features on Casemaker platforms
Accelerated the migration of Casemaker Libra users to the Casemaker 4 platform
Changes made: Prompted password changes
Conducted a code review
Conducted security scans of the Casemaker platform
Installed security features on Casemaker platforms to help mitigate against malicious attacks in the future
Accelerated the migration of Casemaker Libra users to the Casemaker 4 platform as an interim security step
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGFeb 26 · first

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10410.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2021
Raw hash: f8803b9e099e89de20351f777c422d7d51365e0ae0ecf06df695ce50aeb91d32

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFaegre Drinker Biddle & Reath LLP

Victim entityCasemaker, LLC and Lawriter, LLC

Incidentdiscovered Jan 28, 2021

Stated responseEngaged a third-party forensic firm and outside counsel to investigate the matter

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com