HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)LowContained

SMITH GAMBRELL & RUSSELL LLP

bd_4870caeeb4e8f216 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 9, 2021

Filed

Mar 1, 2023

To disclose

19 months

Affected

Not disclosed

Linked

6 filings

Confidence

64%

Full breach record for SMITH GAMBRELL & RUSSELL LLP →6 incidents on file

Smith, Gambrell & Russell, LLP experienced unauthorized access to its IT systems between July 19 and July 28, 2021. The firm discovered the incident on August 9, 2021. Documents containing personal information (names and potentially other data) of clients, primarily related to Aaron's, LLC, were exfiltrated. The firm engaged forensic investigators, reset passwords, deployed endpoint monitoring, and offered 24 months of identity theft protection via IDX. No misuse of data was indicated.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 9, 2021 → Notified Dec 13, 2022491d ✗ CA 60-day late19 months discovery → filing

Incident timeline

undetected · 21 days

discovery → filing · 19 months / 569 days

Jul 19, 2021

Begins

Aug 9, 2021

Discovered

Mar 1, 2023

Filed

vs. sector median

+64 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Vermont State AGbd_37ca2b6de1bd12f42023-01-27 · +33dVerified
Washington State AGbd_be4969b025e7c48d2022-12-13 · +78dVerified
Maine State AGbd_a79f772ed36790182022-08-08 · +205dVerified
Maine State AGbd_2b7bfafa570976dc2022-06-28 · +246dVerified

Show 1 more filing ↓up to 246d gap

Montana State AGbd_eddc405cf41305702022-06-28 · +246dCandidate

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com
Industry: Professional Servicesllm

Discovered: Aug 9, 2021
Breach occurred: Jul 19, 2021 – Jul 28, 2021
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 13, 2022
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Contacted law enforcement

During the incident: Implemented our incident response protocols
Contacted law enforcement
Hired external computer forensic specialists and other consultants
Hired a vendor to review the potentially impacted documents
Notified Aaron's of the incident
Provided Aaron's with access to the potentially impacted documents
Deployed enhanced endpoint monitoring software on our computers and servers
Performed a global password reset for all users
Provided additional security training
Implemented several other security controls
Offering identity theft protection services through IDX
Changes made: Deployed enhanced endpoint monitoring software on our computers and servers
Performed a global password reset for all users
Provided additional security training
Implemented several other security controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 months(569 days from discovery to filing)
Compliance flags: CA 60-day late · 491d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 9, 2021
→ Notified: Dec 13, 2022
491d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 9, 2021 → Notified: Dec 13, 2022	491d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGJun 28 · first

Montana State AGJun 28 · first

Maine State AG+41d

Washington State AG+168d

Vermont State AG+213d

California State AG+246d · this page

Pattern: first filing Jun 28 (ME), last Mar 1 (CA) — a 246-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-563742
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 1, 2023
Raw hash: 622dabd2cedc8827216bd19ab42cfde9cd4fe923ed84cb1690c3a85f114164d5

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySMITH GAMBRELL & RUSSELL LLP

Victim entitySMITH GAMBRELL & RUSSELL LLP

Incidentdiscovered Aug 9, 2021

Stated responseImplemented our incident response protocols

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov