MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedTargetedPIIIdentity (basic)MediumContained

Davis, Hatley, Haffeman & Tighe, P.C.

bd_2f357cc042b86297 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2024

Filed

Jul 18, 2025

To disclose

33 weeks

Affected

1,731state residents only

Linked

4 filings

Confidence

67%

Full breach record for Davis, Hatley, Haffeman & Tighe, P.C. →

Davis, Hatley, Haffeman & Tighe, P.C. notified clients of a ransomware incident discovered on November 29, 2024. Unknown actors gained unauthorized access and encrypted files. Personal information including names and other data was potentially impacted. The firm engaged forensic experts, reported to the FBI, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 33 weeks / 231 days

Nov 29, 2024

Discovered

Jul 18, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_1e1852f16cc87b362025-07-18Verified
Indiana State AGbd_c65b97bf7d5cce222025-07-18Verified
Massachusetts State AGbd_c7fe2f03f78b87842025-07-18Verified

Name: Davis, Hatley, Haffeman & Tighe, P.C.
norm: davis hatley haffeman tighe

Name: Davis, Hatley, Haffeman & Tighe, P.C.
norm: davis hatley haffeman tighe
Industry: Professional Servicesllm

Discovered: Nov 29, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 1,731state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported the incident to the FBI
Initial access: valid_credentials

During the incident: Took steps to secure our network
Launched an investigation with the assistance of independent cybersecurity experts
Enlisted a leading, independent cybersecurity firm to conduct a forensic investigation
Reported the incident to the FBI
Changes made: Implemented several technical measures in our environment to bolster Davis Hatley’s security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(231 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Nebraska State AGJul 18 · first

Indiana State AGJul 18 · first

Massachusetts State AGJul 18 · first

Montana State AGJul 18 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/08/Consumer-notification-letter-22.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 18, 2025
Raw hash: 373446af652c07627476ae63e9e65c24429e430a5023e3ce8931ea55a5676c18

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDavis, Hatley, Haffeman & Tighe, P.C.

Victim entityDavis, Hatley, Haffeman & Tighe, P.C.

Incidentdiscovered Nov 29, 2024

Stated responseTook steps to secure our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov