HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Burr & Forman LLP

bd_2a488a25ec65f451 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 23, 2023

Filed

Jan 10, 2024

To disclose

11 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for Burr & Forman LLP →2 incidents on file

Burr & Forman LLP notified consumers of a data security incident discovered on October 23, 2023, involving anomalous activity on a laptop. An unauthorized actor accessed documents containing names, SSNs, medical coding info, and insurance data. Burr & Forman engaged cybersecurity experts, notified the FBI, and offered 24 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 11 weeks / 79 days

Oct 23, 2023

Discovered

Jan 10, 2024

Filed

vs. sector median

6 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_0d5c7d285321c1382024-01-10Verified
Montana State AGbd_9c70d44242deebc52024-01-10Verified
Indiana State AGbd_936f18390c8af16d2024-01-09 · +1dVerified
HHS OCRbd_b7faab01c06cf85b2024-01-09 · +1dVerified

Show 1 more filing ↓up to 9d gap

Illinois State AGbd_9efbd9555e9e6a212024-01-01 · +9dVerified

Name: Burr & Forman LLP
norm: burr forman

Name: Burr & Forman LLP
norm: burr forman
Industry: Professional Servicesllm

Discovered: Oct 23, 2023
Materiality determined: —
Notification sent: Jan 9, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation
Initial access: valid_credentials

During the incident: Activated its Incident Response Plan
Engaged cybersecurity experts to assist with the investigative process
Notified the Federal Bureau of Investigation
Offering you complimentary credit monitoring and identity protection services through IDX
Changes made: Implemented measures to further enhance network security and minimize the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+8d

HHS OCR+8d

Maine State AG+9d

Montana State AG+9d

Vermont State AG+9d · this page

Pattern: first filing Jan 1 (IL), last Jan 10 (VT) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-01-10-burr-forman-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 10, 2024
Raw hash: 488adb634e0709f8fe7291dda3b81e691ea2e346779c9eee5de6cbbe41724ba4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityBurr & Forman LLP

Victim entityBurr & Forman LLP

Incidentdiscovered Oct 23, 2023

Stated responseActivated its Incident Response Plan

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov