HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Lamson, Dugan, and Murray LLP

bd_3cec7b14d67a7de6 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 22, 2024

Filed

Apr 3, 2025

To disclose

—

Affected

1state residents only

Confidence

66%

Full breach record for Lamson, Dugan, and Murray LLP →

Lamson, Dugan, and Murray LLP (LDM) disclosed a cybersecurity incident affecting one Nebraska resident. LDM became aware of suspicious activity on April 22, 2024, following unauthorized access to systems on March 25, 2024. The unknown actor viewed or downloaded files containing the resident's name, address, and Social Security number. LDM reported the incident to federal law enforcement, engaged cybersecurity specialists, and provided 12 months of credit monitoring through Experian to the affected individual. Notification was sent on April 3, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 28 days

Mar 25, 2024

Begins

Apr 22, 2024

Discovered

Apr 3, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Lamson, Dugan, and Murray LLP
norm: lamson dugan and murray

Name: Lamson, Dugan, and Murray LLP
norm: lamson dugan and murray
Industry: Professional Servicesllm

Discovered: Apr 22, 2024
Breach occurred: Mar 25, 2024
Undetected for: 28 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 3, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported the event to federal law enforcement
Initial access: valid_credentials

During the incident: Took steps to secure its systems
Launched a comprehensive investigation with the assistance of cybersecurity and digital specialists
Reported the event to federal law enforcement
Conducted a comprehensive, third-party review of the files
Undertook a time-intensive, manual effort to assess the nature of the relationship between LDM and the individual records
Changes made: Working to implement additional safeguards and cybersecurity training to its employees
Providing access to credit monitoring services for twelve (12) months, through Experian
Providing potentially affected individuals with guidance on how to better protect against identity theft and fraud
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/74ecb552-bdd3-45a0-a5a8-b2598b16373c.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 3, 2025
Raw hash: d39e90682ad567a707a50094736acdbcd152279508008399147663a3fa9b7438

Reporting entityLamson, Dugan, and Murray LLP

Victim entityLamson, Dugan, and Murray LLP

Incidentdiscovered Apr 22, 2024

Stated responseTook steps to secure its systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov