DisclosureLens
HackingFinancial ServicesFinanceDelayed DiscoveryCustomer Data InvolvedIdentity (basic)Financial accountFinancial credentialsMedium

Marr and Company, P.C.

bd_268da9a3bab8f1e5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 7, 2021

Filed

Jun 13, 2021

To disclose

5 weeks

Affected · nationwide

3,0461 in this filing

Linked

3 filings

Confidence

63%
Full breach record for Marr and Company, P.C.

Marr & Company, P.C., a financial services firm, reported a data breach affecting 3,046 individuals. The incident, an external system breach (hacking), occurred between June 19, 2020, and June 23, 2020, but was not discovered until May 7, 2021. The compromised data included names and financial account numbers or credit/debit card numbers along with their security codes, access codes, passwords, or PINs. Affected individuals were notified on June 2, 2021, and those whose Social Security numbers were impacted were offered 12 months of credit monitoring services.

Maine clockDiscovered May 7, 2021Filed with AG Jun 13, 202137d ME AG >30d5 weeks discovery → filing
AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 322 days
discovery → filing · 5 weeks / 37 days

Jun 19, 2020

Begins

May 7, 2021

Discovered

Jun 13, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Filing propagation · 3 filings · 3 states

View merged incident ↗
Indiana State AGJun 2 · first
Montana State AGJun 2 · first
Maine State AG+11d · this page

Pattern: first filing Jun 2 (IN), last Jun 13 (ME) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.