HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)LowContained

SMITH GAMBRELL & RUSSELL LLP

bd_37ca2b6de1bd12f4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 9, 2021

Filed

Jan 27, 2023

To disclose

18 months

Affected

Not disclosed

Linked

6 filings

Confidence

63%

Full breach record for SMITH GAMBRELL & RUSSELL LLP →6 incidents on file

Smith, Gambrell & Russell, LLP notified consumers of a data breach where unauthorized access to its IT systems occurred between July 19-28, 2021. The firm discovered the incident on August 9, 2021. The breach impacted personal information, including names, of individuals whose data was held on behalf of client Aaron's, LLC. The firm engaged forensic investigators, reset passwords, and offered 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday18 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 21 days

discovery → filing · 18 months / 536 days

Jul 19, 2021

Begins

Aug 9, 2021

Discovered

Oct 25, 2022

Scope determined

Jan 27, 2023

Filed

vs. sector median

+59 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_4870caeeb4e8f2162023-03-01 · +33dVerified
Washington State AGbd_be4969b025e7c48d2022-12-13 · +45dVerified
Maine State AGbd_a79f772ed36790182022-08-08 · +172dVerified
Maine State AGbd_2b7bfafa570976dc2022-06-28 · +213dVerified

Show 1 more filing ↓up to 213d gap

Montana State AGbd_eddc405cf41305702022-06-28 · +213dCandidate

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com
Industry: Professional Servicesllm

Discovered: Aug 9, 2021
Breach occurred: Jul 19, 2021 – Jul 28, 2021
Undetected for: 21 daysoccurrence → discovery
Materiality determined: Oct 25, 2022
Notification sent: Dec 13, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Notified and cooperating with law enforcement

During the incident: Implemented incident response protocols
Contacted law enforcement
Hired external computer forensic specialists and other consultants
Hired a vendor to review the potentially impacted documents
Notified Aaron's of the incident
Provided Aaron's with access to the potentially impacted documents
Deployed enhanced endpoint monitoring software on computers and servers
Performed a global password reset for all users
Provided additional security training
Implemented several other security controls
Offering identity theft protection services through IDX
Changes made: Deployed enhanced endpoint monitoring software on computers and servers
Performed a global password reset for all users
Provided additional security training
Implemented several other security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 months(536 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGJun 28 · first

Montana State AGJun 28 · first

Maine State AG+41d

Washington State AG+168d

Vermont State AG+213d · this page

California State AG+246d

Pattern: first filing Jun 28 (ME), last Mar 1 (CA) — a 246-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-01-27-smith-gambrell-russell-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2023
Raw hash: d7915ce7130fa4eed465a4ac4c12a5d0ec7aeec945aec6b982e3e3cd9f58fa17

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySMITH GAMBRELL & RUSSELL LLP

Victim entitySMITH GAMBRELL & RUSSELL LLP

Incidentdiscovered Aug 9, 2021

Stated responseImplemented incident response protocols

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov