HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancialMediumContained

Maloney & Kennedy, PLLC

bd_43c3345c35e9f8bf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 15, 2017

Filed

Mar 29, 2017

To disclose

6 weeks

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Maloney & Kennedy, PLLC →

Maloney & Kennedy, PLLC notified clients that an unknown third party accessed client tax return data, including names, addresses, SSNs, and 2015 tax information, by filing returns fraudulently. The firm discovered the incident on Feb 15, 2017, engaged forensic experts, and offered one year of Equifax Credit Watch Gold identity protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 42 days

Feb 15, 2017

Discovered

Mar 29, 2017

Filed

vs. sector median

13 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_729617a4244aa2fa2017-03-29Verified
Massachusetts State AGbd_af02b280fa7aa5a82017-03-29Verified

Name: Maloney & Kennedy, PLLC
norm: maloney kennedy

Name: Maloney & Kennedy, PLLC
norm: maloney kennedy
Industry: Professional Servicesllm

Discovered: Feb 15, 2017
Materiality determined: —
Notification sent: Mar 29, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Contacted the IRS
Initial access: valid_credentials

During the incident: Contacted the IRS
Began an investigation
Retained computer experts to review systems
Provided the IRS with information to monitor accounts
Arranged with Equifax Personal Solutions for identity theft protection
Instituted additional security protocols
Changes made: Instituted additional security protocols
Implemented additional passwords
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 29 · first

Massachusetts State AGMar 29 · first

Montana State AGMar 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Maloney-Kennedy-PLLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 29, 2017
Raw hash: e24bb262486f99d713746d5cd1617f312824bef6dd858478fd9eb6ed1fcc0f3f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMaloney & Kennedy, PLLC

Victim entityMaloney & Kennedy, PLLC

Incidentdiscovered Feb 15, 2017

Stated responseContacted the IRS

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov