HackingProfessional ServicesFinancial ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHighContained

Ives & Sultan LLP

bd_29e66b2c3b84f6ec · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 1, 2017

Filed

May 8, 2017

To disclose

10 weeks

Affected · nationwide

3,0002 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Ives & Sultan LLP →

Ives & Sultan LLP, an accounting firm, notified the NH AG of a data breach where an unauthorized party used an employee's stolen credentials to access the SmartVault portal in November 2016. Approximately 3,000 client documents containing PII, SSNs, and financial data were accessed. The firm engaged forensic experts, reset credentials, and offered 1 year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 120 days

discovery → filing · 10 weeks / 68 days

Nov 1, 2016

Begins

Mar 1, 2017

Discovered

May 8, 2017

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_70ce1f32c43930312017-05-08Verified

Name: Stewart Bernstiel Rebar & Smith LLP
norm: stewart bernstiel rebar smith

Name: Ives & Sultan LLP
norm: ives sultan
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: Mar 1, 2017
Breach occurred: Nov 1, 2016
Undetected for: 120 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 15, 2017
Affected individuals: 3,000state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged a forensic expert to investigate
Changed the employee's passwords
Notified Smart Vault of the issue
Sent notification letters to affected New Hampshire residents
Offered one year of free identity monitoring services
Changes made: Implementing and enforcing security measures and protocols designed to safeguard clients' documents and information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 8 · first

New Hampshire State AGMay 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ives-sultan-20170508.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 8, 2017
Raw hash: 073f2ab87405df3a82ac93692c8f73d7babb3917aa352f89d2dfb0c6ed02630b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStewart Bernstiel Rebar & Smith LLP

Victim entityIves & Sultan LLP

Incidentdiscovered Mar 1, 2017

Stated responseEngaged a forensic expert to investigate

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov