MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedTargetedPIIPHIIdentity (basic)Health (basic)LowContained

Troutman Pepper Hamilton Sanders LLP

bd_278fc73071292b7e · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 8, 2023

Filed

Dec 15, 2023

To disclose

44 weeks

Affected

10state residents only

Linked

6 filings

Confidence

66%

Full breach record for Troutman Pepper Hamilton Sanders LLP →

Troutman Pepper Hamilton Sanders LLP notified the NH Attorney General of a ransomware incident detected on Feb 8, 2023. Unauthorized access led to file exfiltration. PII and PHI of ~10 NH residents were impacted. Notification sent Dec 4, 2023. FBI notified. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d44 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 44 weeks / 310 days

Feb 8, 2023

Begins

Feb 8, 2023

Discovered

Dec 15, 2023

Filed

vs. sector median

+27 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by black_basta about this victim predates this filing by 266 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteblack_bastabd_28a054e3a775be892023-03-23 · +266dCandidate

Regulatory filings (4) · sorted by filing gap

California State AGbd_23785f748b0bdd012023-12-04 · +11dVerified
Massachusetts State AGbd_30048867f7068b2f2023-12-04 · +11dVerified by operator
Vermont State AGbd_3f67dde8ca1ace852023-12-04 · +11dVerified
Montana State AGbd_5d30fecba2fb58872023-12-04 · +11dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Troutman Pepper Hamilton Sanders LLP
norm: troutman pepper hamilton sanders
Domain: troutman.com
Industry: Professional Servicesllm

Discovered: Feb 8, 2023
Breach occurred: Feb 8, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2023
Affected individuals: 10state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General, Consumer Protection Bureau, New Hampshire

During the incident: Immediately took steps to secure its network and mitigate against any additional harm
Reported the incident to the Federal Bureau of Investigation
Launched an investigation in consultation with outside cybersecurity professionals
Provided notice of the incident to the major credit reporting agencies including Experian, Equifax, and TransUnion
Offering the residents with complimentary memberships with a credit monitoring service
Changes made: Strengthened the network
Made additional security improvements recommended by third-party cyber security experts
Resetting account passwords
Strengthening password security policies
Endpoint detection software
Integrating a 24/7 third-party security monitoring service
Enhancing records management practices
Implementing additional training related to network security and threat detection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(310 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

California State AGDec 4 · first

Massachusetts State AGDec 4 · first

Vermont State AGDec 4 · first

Montana State AGDec 4 · first

New Hampshire State AG+11d · this page

Pattern: first filing Dec 4 (CA), last Dec 15 (NH) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/troutman-pepper-hamilton-sanders-20231215.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 15, 2023
Raw hash: d1dc9b5a07fb9e818bc8a2e4ad469bb8e9462afeda572e7b7b2542e1c466c0c6

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityTroutman Pepper Hamilton Sanders LLP

Incidentdiscovered Feb 8, 2023

Stated responseImmediately took steps to secure its network and mitigate against any additional harm

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov