HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Cutcliffe Archetto & Santilli

bd_24115aa69154ca11 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 11, 2025

Filed

Oct 15, 2025

To disclose

5 weeks

Affected · nationwide

7494 in this filing

Linked

7 filings

Confidence

66%

Full breach record for Cutcliffe Archetto & Santilli →

Cutcliffe Archetto & Santilli, a Rhode Island law firm, disclosed a cybersecurity incident occurring on May 22, 2025, discovered on September 11, 2025. The breach affected 749 individuals, including 4 Maine residents. Personal information exposed included names, addresses, dates of birth, and Social Security Numbers. The firm engaged forensic investigators, notified law enforcement, and provided 12 months of credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Sep 11, 2025 → Filed with AG Oct 15, 202534d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 112 days

discovery → filing · 5 weeks / 34 days

May 22, 2025

Begins

Sep 11, 2025

Discovered

Oct 15, 2025

Filed

vs. sector median

14 wks faster

This filing is one of 7 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 121 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteakirabd_79b175df44f5d9c12025-06-25 · +111dVerified by operator
Leak Siteakirabd_b6119bec1e5dcd5f2025-06-16 · +121dVerified by operator

Regulatory filings (4) · sorted by filing gap

Vermont State AGbd_d1134e6e232556ab2025-10-15Verified by operator
Massachusetts State AGbd_8427eccecd392a032025-10-16 · +1dVerified by operator
New Hampshire State AGbd_b853d9342a1413432025-10-16 · +1dVerified
Massachusetts State AGbd_478187e2982542b02025-12-19 · +65dVerified by operator

Name: Cutcliffe Archetto & Santilli
norm: cutcliffe archetto santilli
Domain: cutcliffearchetto.com

Name: Cutcliffe Archetto & Santilli
norm: cutcliffe archetto santilli
Domain: cutcliffearchetto.com
Industry: Professional Servicesllm

Discovered: Sep 11, 2025
Breach occurred: May 22, 2025
Undetected for: 112 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2025
Affected individuals: 749state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: exploit_public_facing

During the incident: Moved quickly to secure our network
Notify law enforcement
Launched a thorough investigation
Performed investigation with the aid of independent IT security and forensic investigators
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Changes made: Review our processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(34 days from discovery to filing)
Compliance flags: ME AG >30d · 34dLeak >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Sep 11, 2025
→ Filed with AG: Oct 15, 2025
34d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Sep 11, 2025 → Filed with AG: Oct 15, 2025	34d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Vermont State AGOct 15 · first

Maine State AGOct 15 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+1d

Massachusetts State AG+65d

Pattern: first filing Oct 15 (VT), last Dec 19 (MA) — a 65-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9c17b9f1-2303-47fe-baae-7101706d4061.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 15, 2025
Raw hash: c2cc961b39991b20d2bcc7e14162fc1782ebc54a24a0a637cca11266a0945460

Linked disclosures

Ransomware claims (2)

Regulatory filings (4) · sorted by filing gap

Reporting entityCutcliffe Archetto & Santilli

Victim entityCutcliffe Archetto & Santilli

Incidentdiscovered Sep 11, 2025

Stated responseMoved quickly to secure our network

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov