HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Vocatura, Spagnuolo & Company, P.C., CPAs

bd_378f1bb086d59a84 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 16, 2025

Filed

Dec 17, 2025

To disclose

22 weeks

Affected

31state residents only

Linked

3 filings

Confidence

67%

Full breach record for Vocatura, Spagnuolo & Company, P.C., CPAs →

Vocatura, Spagnuolo & Company, P.C., CPAs notified the New Hampshire Attorney General on December 17, 2025, of a data event affecting 31 New Hampshire residents. On or about July 16, 2025, unauthorized access to a single email account occurred, potentially exposing names, Social Security numbers, and financial account/routing numbers. Vocatura conducted an investigation, identified affected individuals, and provided 12 months of complimentary credit monitoring through TransUnion/Cyberscout. The incident status is contained.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 154 days

Jul 16, 2025

Discovered

Dec 17, 2025

Filed

vs. sector median

+2 wks slower

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_970ab69b1c31cf1b2025-12-17Verified
Maine State AGbd_f1baeb5c9199360a2025-12-17Candidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Vocatura, Spagnuolo & Company, P.C., CPAs
norm: vocatura spagnuolo company pc cpas
Industry: professional_services
Industry: Professional Servicesllm

Discovered: Jul 16, 2025
Materiality determined: —
Notification sent: Dec 17, 2025
Affected individuals: 31state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: valid_credentials

During the incident: Conducted an investigation to determine what occurred
Completed a comprehensive review to determine their contents and to whom the contents related
Worked to identify contact information so we could let those individuals know about this matter
Provided access to credit monitoring services for twelve (12) months, through TransUnion, to individuals whose personal information was potentially involved in this incident, at no cost to these individuals
Providing individuals with guidance on how to better protect against identity theft and fraud
Providing individuals with information on how to place a fraud alert and security freeze on one’s credit file
Providing individuals with information on how to obtain a free credit report
Changes made: Continue to evaluate our policies, procedures, staff training, and technical security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(154 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 17 · first

Maine State AGDec 17 · first

New Hampshire State AGDec 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vocatura-spagnuolo-cpas-20251217.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 17, 2025
Raw hash: 04cf2d874995cf3117b225f583bd8ef38a717a088dcb1b5cc982fa3cfd284c14

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityVocatura, Spagnuolo & Company, P.C., CPAs

Incidentdiscovered Jul 16, 2025

Stated responseConducted an investigation to determine what occurred

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov