HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryPIIMediumContained

Ott Cone & Redpath, P.A.

bd_4522d49d8820a6c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 31, 2024

Filed

Dec 13, 2024

To disclose

6 weeks

Affected · nationwide

12,2869 in this filing

Linked

5 filings

Confidence

80%

Full breach record for Ott Cone & Redpath, P.A. →

Ott Cone & Redpath, P.A., a law firm based in Greensboro, NC, experienced an external system breach (hacking) on June 3–4, 2024. The breach was discovered on October 31, 2024, approximately five months after it occurred. A total of 12,286 individuals were affected nationwide, including 9 Maine residents. Affected individuals were notified in writing on December 13, 2024. IDX was engaged to provide 12 months of ID restoration and credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Oct 31, 2024 → Filed with AG Dec 13, 202443d ⏱ ME AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 150 days

discovery → filing · 6 weeks / 43 days

Jun 3, 2024

Begins

Oct 31, 2024

Discovered

Dec 13, 2024

Filed

vs. sector median

13 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_0be51e9ca9dbbe372024-12-13Verified
New Hampshire State AGbd_15a339fb6f756dd72024-12-16 · +3dVerified
HHS OCRbd_489f86145f653c992024-12-18 · +5dVerified
Maryland State AGbd_cc66493ca7870bbf2025-01-02 · +20dVerified

Name: Ott Cone & Redpath, P.A.
norm: ott cone redpath
Industry: Legal Services

Name: Ott Cone & Redpath, P.A.
norm: ott cone redpath
Industry: Legal Services
Industry: Professional Servicesllm

Discovered: Oct 31, 2024
Breach occurred: Jun 3, 2024 – Jun 4, 2024
Undetected for: 150 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 13, 2024
Affected individuals: 12,286state + nationwide
Data types: PII
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Written notification sent to affected Maine residents on 12/13/2024
Identity theft protection services offered through IDX
Changes made: Identity theft protection services offered via IDX (12 months of ID restoration and credit monitoring services)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: ME AG >30d · 43d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Oct 31, 2024
→ Filed with AG: Dec 13, 2024
43d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Oct 31, 2024 → Filed with AG: Dec 13, 2024	43d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGDec 13 · first

Maine State AGDec 13 · first · this page

New Hampshire State AG+3d

HHS OCR+5d

Maryland State AG+20d

Pattern: first filing Dec 13 (MT), last Jan 2 (MD) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/be48630b-bf45-425d-95e3-ae33e552a351.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 13, 2024
Raw hash: 5464d13cc69efc5367f0a2ad13041e188bb5f26d3f100a436c7738f8d8ead8c7

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOtt Cone & Redpath, P.A.

Victim entityOtt Cone & Redpath, P.A.

Incidentdiscovered Oct 31, 2024

Stated responseWritten notification sent to affected Maine residents on 12/13/2024

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov