HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Troy A. Washko, CPA, P.C.

bd_4579840c7b8312c9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2020

Filed

Jan 6, 2021

To disclose

31 weeks

Affected

1state residents only

Linked

5 filings

Confidence

65%

Full breach record for Troy A. Washko, CPA, P.C. →2 incidents on file

Troy A. Washko, CPA, P.C. notified the NH Attorney General of unauthorized access to an employee's email, Dropbox, and Microsoft Teams accounts on June 24, 2020. The firm detected unusual activity in June 2020. Personal information, including name and Social Security number, of one New Hampshire resident was potentially accessible. The firm reset passwords, engaged forensic investigators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 24, 2020

Begins

Jan 6, 2021

Filed

vs. sector median

+14 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1953e122019e1b1f2020-12-24 · +13dVerified
Indiana State AGbd_66d7fc24b6a64d8b2020-12-24 · +13dVerified
Maine State AGbd_6bb497b2fb64b09a2020-12-24 · +13dCandidate
Montana State AGbd_e0596a045fbf7cb92020-12-24 · +13dVerified by operator

Name: Troy A. Washko, CPA, P.C.
norm: troy a washko cpa

Name: Troy A. Washko, CPA, P.C.
norm: troy a washko cpa
Industry: Professional Servicesllm

Discovered: Jun 1, 2020
Breach occurred: Jun 24, 2020
Materiality determined: —
Notification sent: Dec 24, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney GeneralProviding notice of this event to other regulators as may be required under applicable state law

During the incident: Commenced an investigation, working with third-party IT and forensic investigators
Reset relevant passwords on June 24, 2020
Undertook a comprehensive review of the contents of the three accounts
Provided written notice of this incident to potentially affected individuals
Offering complimentary access to twelve (12) months of credit and identity monitoring services, including identity restoration services, through Equifax and TransUnion for affected individuals
Provided affected individuals with guidance on how to better protect themselves against identity theft and fraud
Changes made: Reviewing and enhancing existing policies and procedures
Deployment of multi-factor authentication for our accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(219 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGDec 24 · first

Indiana State AGDec 24 · first

Maine State AGDec 24 · first

Montana State AGDec 24 · first

New Hampshire State AG+13d · this page

Pattern: first filing Dec 24 (MA), last Jan 6 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/troy-washko-20210106.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 6, 2021
Raw hash: 4dd6d53cf92792b5eb613eebcfadc145d54c44c9b3fffeda4078b48d67abab8b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTroy A. Washko, CPA, P.C.

Victim entityTroy A. Washko, CPA, P.C.

Incidentdiscovered Jun 1, 2020

Stated responseCommenced an investigation, working with third-party IT and forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov