HackingProfessional ServicesProfessional ServicesData ExfiltratedTargetedIdentity (basic)MediumContained

Davidoff Hutcher & Citron LLP

bd_3b37ea23e9b37e6b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 18, 2023

Filed

Aug 9, 2024

To disclose

29 days

Affected · nationwide

21,69125 in this filing

Linked

8 filings

Confidence

66%

Full breach record for Davidoff Hutcher & Citron LLP →2 incidents on file

Davidoff Hutcher & Citron LLP reported an external system breach (hacking) occurring between January 12, 2023, and August 18, 2023. The firm discovered the incident on July 11, 2024, after an investigation determined an unauthorized party may have removed files containing client names. 21,691 individuals were affected, including 25 Maine residents. The firm engaged external cybersecurity professionals, contained the threat, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 18, 2023 → Filed with AG Aug 9, 2024357d ✗ ME AG >90d29 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 218 days

discovery → filing · 51 weeks / 357 days

Jan 12, 2023

Begins

Aug 18, 2023

Discovered

Aug 9, 2024

Filed

vs. sector median

15 wks faster

This filing is one of 8 about the same incident.View merged incident

A leak claim by alphv about this victim predates this filing by 354 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_4d665d6a92b5ce582023-08-21 · +354dVerified by operator

Regulatory filings (6) · sorted by filing gap

Indiana State AGbd_cd245bb64f6273b42024-08-19 · +10dVerified by operator
Montana State AGbd_56edfa3d945c42d02024-08-20 · +11dVerified by operator
California State AGbd_f03d3a1a868c42862024-08-20 · +11dVerified by operator
Vermont State AGbd_71369198ffef49ce2024-08-21 · +12dVerified

Show 2 more filings ↓up to 17d gap

Massachusetts State AGbd_9beb0a4154edab632024-08-21 · +12dVerified
New Hampshire State AGbd_8c5c00a3b5bf96f72024-08-26 · +17dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Davidoff Hutcher & Citron LLP
norm: davidoff hutcher citron
Industry: Professional Servicesllm

Discovered: Aug 18, 2023
Breach occurred: Jan 12, 2023 – Aug 18, 2023
Undetected for: 218 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 9, 2024
Affected individuals: 21,691state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Contained the threat by disabling all unauthorized access to our network
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering a complimentary 12 month membership of Single Bureau Credit Monitoring
Providing proactive fraud assistance through Cyberscout
Changes made: Continually evaluate and modify practices to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: ME AG >90d · 357dME resident >180d · 357dLeak >180d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 18, 2023
→ Filed with AG: Aug 9, 2024
357d 90 days ME AG >90d
Maine
Discovered: Aug 18, 2023
→ Notified: Aug 9, 2024
357d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 18, 2023 → Filed with AG: Aug 9, 2024	357d	90 days	ME AG >90d
Maine	Discovered: Aug 18, 2023 → Notified: Aug 9, 2024	357d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Maine State AGAug 9 · first · this page

Indiana State AG+10d

Montana State AG+11d

California State AG+11d

Vermont State AG+12d

Massachusetts State AG+12d

New Hampshire State AG+17d

Pattern: first filing Aug 9 (ME), last Aug 26 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a21f5ed5-60e6-4da2-9d8d-1345331e87d1.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 9, 2024
Raw hash: 52c153931fd9a4d5f660347751aa4070b1d64a682bde029dd324195d7753b3b1

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityDavidoff Hutcher & Citron LLP

Incidentdiscovered Aug 18, 2023

Stated responseContained the threat by disabling all unauthorized access to our network

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov