HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Grellas Shah LLP

bd_3ca83b0554b466cb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 15, 2022

Filed

Sep 1, 2022

To disclose

7 weeks

Affected

4state residents only

Linked

6 filings

Confidence

66%

Full breach record for Grellas Shah LLP →

Grellas Shah LLP, a law firm in Cupertino, CA, notified the New Hampshire Attorney General of a cybersecurity incident involving unauthorized access to employee email accounts between December 20, 2021, and March 28, 2022. The breach affected 4 New Hampshire residents, exposing names, Social Security numbers, and financial account numbers. Grellas engaged a cybersecurity firm, secured accounts, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 207 days

discovery → filing · 7 weeks / 48 days

Dec 20, 2021

Begins

Jul 15, 2022

Discovered

Sep 1, 2022

Filed

vs. sector median

12 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_4a9d9d1978f1c6782022-09-01Verified
California State AGbd_50f122b56b1dddef2022-09-01Candidate
Maine State AGbd_57d0ecb4ab2237332022-09-01Verified
Montana State AGbd_a1a6335d399500ab2022-09-01Verified by operator

Show 1 more filing ↓

Massachusetts State AGbd_bbba80dfc3d4fe7f2022-09-01Verified

Name: Grellas Shah LLP
norm: grellas shah

Name: Grellas Shah LLP
norm: grellas shah
Industry: Professional Servicesllm

Discovered: Jul 15, 2022
Breach occurred: Dec 20, 2021 – Mar 28, 2022
Undetected for: 207 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: valid_credentials

During the incident: Took steps to secure the email accounts
A cybersecurity firm was engaged
Conducted a review of the emails and attachments in the mailboxes to identify any personal information
Preparing to mail notification letters to the New Hampshire residents
Offering a complimentary one-year membership in credit monitoring and identity theft protection services through Equifax
Establishing a dedicated call center for individuals to call with questions
Changes made: Implemented additional measures to enhance its cybersecurity defenses and security protocols
Continues to educate its employees on the importance of data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(48 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Indiana State AGSep 1 · first

California State AGSep 1 · first

Maine State AGSep 1 · first

Montana State AGSep 1 · first

Massachusetts State AGSep 1 · first

New Hampshire State AGSep 1 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/grellas-shah-20220901.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2022
Raw hash: 74b749e527098393796e537b854e99138117cea207ef8effd18a22a1e7a8f034

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityGrellas Shah LLP

Victim entityGrellas Shah LLP

Incidentdiscovered Jul 15, 2022

Stated responseTook steps to secure the email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov