HackingProfessional ServicesProfessional ServicesVulnerability ExploitCapture Stored DataTargetedData ExfiltratedBiometricFinancial accountFinancial credentialsHealth (basic)Identity (basic)Government IDPHIHighContained

Stevens & Lee, P.C.

bd_2a5004aeb0b0d85e · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 28, 2021

Filed

Apr 8, 2022

To disclose

41 weeks

Affected

1,028state residents only

Linked

9 filings

Confidence

69%

Full breach record for Stevens & Lee, P.C. →

Stevens & Lee, a Pennsylvania law firm, reported unauthorized access to systems on June 28, 2021. The breach affected 1,028 Washington residents, exposing names, DOBs, driver's licenses, medical info, biometric data, financial info, and SSNs. Notifications were sent April 7, 2022. The firm engaged forensic investigators, secured systems, and offered 24 months of credit monitoring and identity protection services.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d41 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 41 weeks / 284 days

Jun 28, 2021

Begins

Jun 28, 2021

Discovered

Apr 8, 2022

Filed

vs. sector median

+23 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

New Hampshire State AGbd_4656c94467fb53f82022-04-08Verified
California State AGbd_6f048ed8e6069b6d2022-04-08Verified
Indiana State AGbd_8595f31aba5e1b312022-04-07 · +1dVerified
Montana State AGbd_9e8a88c402d7b5742022-04-07 · +1dVerified

Show 4 more filings ↓up to 101d gap

Maine State AGbd_3ca4b4db5aeb36fc2022-04-11 · +3dVerified
Massachusetts State AGbd_3fbea7979b3153812022-01-03 · +95dVerified
Maine State AGbd_c7efad509311ce922021-12-30 · +99dVerified
Maine State AGbd_94e9b155293374322021-12-28 · +101dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Stevens & Lee, P.C.
norm: stevens lee
Industry: Professional Servicesllm

Discovered: Jun 28, 2021
Breach occurred: Jun 28, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 7, 2022
Affected individuals: 1,028state-resident count only
Data types: Identity (basic)Government IDHealth (basic)BiometricFinancial accountFinancial credentials
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthMedical informationBiometric data
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Engaged a digital forensics firm to assist
Secured network systems
Reported the incident to law enforcement
Offered 24 months of complimentary credit monitoring, dark web monitoring, identity theft insurance and identity restoration through IDX
Changes made: Working with leading cybersecurity experts to enhance the security of its network
Increasing password complexity requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 41 weeks(284 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Maine State AGDec 28 · first

Maine State AG+2d

Massachusetts State AG+6d

Indiana State AG+100d

Montana State AG+100d

New Hampshire State AG+101d

California State AG+101d

Washington State AG+101d · this page

Maine State AG+104d

Pattern: first filing Dec 28 (ME), last Apr 11 (ME) — a 104-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA7850.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2022
Raw hash: 418850b255cfdf150a524f905b1b37909779efbcd44cdf3fa991bcc283bcae60

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityStevens & Lee, P.C.

Incidentdiscovered Jun 28, 2021

Stated responseEngaged a digital forensics firm to assist

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com