HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedTargetedIdentity (basic)LowContained

William C Smith and Company

bd_25c5ba185c56f606 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 18, 2025

Filed

Jan 12, 2026

To disclose

34 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

67%

Full breach record for William C Smith and Company →

William C. Smith and Company notified consumers of a data breach occurring between May 5 and May 18, 2025. An unknown actor accessed systems and exfiltrated files containing names and other personal information. The company isolated systems, engaged third-party specialists, notified law enforcement, and offered credit monitoring. The incident status is contained.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday34 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 13 days

discovery → filing · 34 weeks / 239 days

May 5, 2025

Begins

May 18, 2025

Discovered

Jan 12, 2026

Filed

vs. sector median

+15 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_56f0b4a9196917002026-01-12Verified
Massachusetts State AGbd_7cc212da57ce3c8d2026-01-12Verified
Indiana State AGbd_66202ec12ea406782026-01-09 · +3dCandidate
Indiana State AGbd_f30f9d046daa93a72026-01-09 · +3dCandidate

Name: William C Smith and Company
norm: william c smith and

Name: William C Smith and Company
norm: william c smith and
Industry: Professional Servicesllm

Discovered: May 18, 2025
Breach occurred: May 5, 2025 – May 18, 2025
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 12, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: notifying applicable state regulators
Initial access: valid_credentials

During the incident: Moved quickly to isolate the systems
Launched an investigation with the assistance of third-party specialists
Undertook a thorough review of the impacted and potentially impacted files
Notified federal law enforcement
Notifying applicable state regulators
Providing you with access to [extra3_12or24] months of credit monitoring at no charge through Experian
Changes made: Reviewing our protocols, policies, and procedures to reduce the likelihood of a similar event occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(239 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Indiana State AGJan 9 · first

Maine State AG+3d

Massachusetts State AG+3d

Vermont State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2026-01-12-william-c-smith-and-company-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2026
Raw hash: 7cc68135359cf001ff0b2fcc611af42566db55bc0a7ca86c91cace76b96f955b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilliam C Smith and Company

Victim entityWilliam C Smith and Company

Incidentdiscovered May 18, 2025

Stated responseMoved quickly to isolate the systems

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov