HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

Macfarlane Ferguson & McMullen

bd_28f879d8bf362ea8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 8, 2023

Filed

Feb 9, 2024

To disclose

48 weeks

Affected

11state residents only

Linked

4 filings

Confidence

66%

Full breach record for Macfarlane Ferguson & McMullen →

Macfarlane Ferguson & McMullen, a Florida-based law firm, notified the NH Attorney General of a data security incident affecting 11 NH residents. On March 8, 2023, the firm detected unusual activity indicating unauthorized network access by an unknown criminal actor. Personal information was accessed. The firm engaged forensic experts, reported to the FBI, and mailed notices on Feb 9, 2024, offering 12 months of identity protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 48 weeks / 338 days

Mar 8, 2023

Discovered

Feb 6, 2024

Scope determined

Feb 9, 2024

Filed

vs. sector median

+30 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_5c4660e61e2cd25d2024-02-09Verified
Massachusetts State AGbd_a4592b33289ea93b2024-02-09Verified
Montana State AGbd_f0fafb926dda63902024-02-09Candidate

Name: Macfarlane Ferguson & McMullen
norm: macfarlane ferguson mcmullen

Name: Macfarlane Ferguson & McMullen
norm: macfarlane ferguson mcmullen
Industry: Professional Servicesllm

Discovered: Mar 8, 2023
Materiality determined: Feb 6, 2024
Notification sent: Feb 9, 2024
Affected individuals: 11state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Retained cybersecurity experts and launched a forensics investigation
Implemented additional security measures to further harden its digital environment
Reported the incident to the FBI
Mailed notification letters to affected New Hampshire residents
Offered 12 months of complimentary identity protection services through Cyberscout/Identity Force
Changes made: Implemented additional security measures to further harden its digital environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 48 weeks(338 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGFeb 9 · first

Massachusetts State AGFeb 9 · first

Montana State AGFeb 9 · first

New Hampshire State AGFeb 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/macfarlane-ferguson-mcmullen-20240209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2024
Raw hash: f555c23b1d4db63fdbe483a45fe5be9b027097086db2247b3484c6746508e7fa

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMacfarlane Ferguson & McMullen

Victim entityMacfarlane Ferguson & McMullen

Incidentdiscovered Mar 8, 2023

Stated responseRetained cybersecurity experts and launched a forensics investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov