HackingProfessional ServicesProfessional ServicesData ExfiltratedTargetedIdentity (basic)LowContained

Tami J. Dunham, CPA

bd_3977ffba57ce2eea · schema v1 · pii pii-v1

Severity

Low

Discovered

May 24, 2025

Filed

Nov 26, 2025

To disclose

27 weeks

Affected · nationwide

8021 in this filing

Linked

4 filings

Confidence

65%

Full breach record for Tami J. Dunham, CPA →

Tami J. Dunham, CPA reported an external system breach (hacking) occurring May 24-26, 2025. The incident affected 802 individuals, including 1 Maine resident. Files were viewed and downloaded by an unknown actor. The firm engaged cybersecurity specialists and third-party data review specialists. Affected individuals received notification on November 26, 2025, and were offered 12 months of credit monitoring and identity restoration services through Epiq.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered May 24, 2025 → Filed with AG Nov 26, 2025186d ⏱ ME AG >30d27 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 27 weeks / 186 days

May 24, 2025

Begins

May 24, 2025

Discovered

Nov 26, 2025

Filed

vs. sector median

+7 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_1785f2e4a0a5189f2025-11-26Verified
California State AGbd_67946750d4824c2a2025-11-26Verified
Nebraska State AGbd_c0e9c7d2f05b25f22025-11-26Verified

Name: Tami J. Dunham, CPA
norm: tami j dunham cpa
Domain: tdunhamcpa.com

Name: Tami J. Dunham, CPA
norm: tami j dunham cpa
Domain: tdunhamcpa.com
Industry: Professional Servicesllm

Discovered: May 24, 2025
Breach occurred: May 24, 2025 – May 26, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 26, 2025
Affected individuals: 802state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: External
Initial access: exploit_public_facing

During the incident: Undertook an extensive investigation with the assistance of cybersecurity specialists
Conducted a comprehensive analysis of the affected files with the assistance of third-party data review specialists
Undertook a time-intensive manual review of the records to validate the information
Offering complimentary credit monitoring and identity restoration services for 12 months through Epiq
Changes made: Reviewed existing policies and procedures
Enhanced certain administrative and technical controls
Changed external IT firm
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(186 days from discovery to filing)
Compliance flags: ME AG >30d · 186dME resident >60d · 186d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: May 24, 2025
→ Filed with AG: Nov 26, 2025
186d 30 days (soft) ME AG >30d
Maine
Discovered: May 24, 2025
→ Notified: Nov 26, 2025
186d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: May 24, 2025 → Filed with AG: Nov 26, 2025	186d	30 days (soft)	ME AG >30d
Maine	Discovered: May 24, 2025 → Notified: Nov 26, 2025	186d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGNov 26 · first

California State AGNov 26 · first

Nebraska State AGNov 26 · first

Maine State AGNov 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6cd240a5-1052-4a3f-b83a-a84d81f4c7b6.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 26, 2025
Raw hash: 320d9ab87d838015d8488a2288e7696f4e278093ae504fbb512054f13ed6fe9a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTami J. Dunham, CPA

Victim entityTami J. Dunham, CPA

Incidentdiscovered May 24, 2025

Stated responseUndertook an extensive investigation with the assistance of cybersecurity specialists

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov