HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Finnegan, Marks, Desmond & Jones

bd_2e5a4f3c40c4de5a · schema v1 · pii pii-v2

Severity

Medium

Discovered

Feb 13, 2025

Filed

Jan 5, 2026

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Finnegan, Marks, Desmond & Jones →

Finnegan, Marks, Desmond & Jones notified Nebraska AG of a breach affecting one Nebraska resident. Unauthorized access to a single employee email account occurred between Nov 21, 2024, and Feb 13, 2025. The attacker downloaded email contents, exposing the resident's name and Social Security number. FMDJ engaged forensic specialists and a data review vendor. Notification was sent on Jan 5, 2026, offering one year of credit monitoring via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 84 days

Nov 21, 2024

Begins

Feb 13, 2025

Discovered

Jan 5, 2026

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_71d9821a2ac517f92026-01-05Candidate

Name: Finnegan, Marks, Desmond & Jones
norm: finnegan marks desmond jones

Name: Finnegan, Marks, Desmond & Jones
norm: finnegan marks desmond jones
Industry: Professional Servicesllm

Discovered: Feb 13, 2025
Breach occurred: Nov 21, 2024 – Feb 13, 2025
Undetected for: 84 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 5, 2026
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Engaged third-party forensic specialists
Engaged a data review vendor to conduct a comprehensive review of the contents of the email account
Secured its email environment
Provided access to credit monitoring services for one (1) year through TransUnion
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implementing additional safeguards and training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGJan 5 · first

Nebraska State AGJan 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/b6905f92-d6e8-4825-8b80-e4b0d709c412.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 5, 2026
Raw hash: ad1532c87a4d84656b8a5e1a79f3dca8e71ed0011bf6647a6f2fe5cbe5fa2aba

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFinnegan, Marks, Desmond & Jones

Victim entityFinnegan, Marks, Desmond & Jones

Incidentdiscovered Feb 13, 2025

Stated responseEngaged third-party forensic specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov