HackingProfessional ServicesProfessional ServicesVulnerability ExploitCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Nakawatase & Kaminsky, CPAs, LLP

bd_4d316e7bbe8a8069 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2017

Filed

Feb 3, 2017

To disclose

5 weeks

Affected

Not disclosed

Confidence

63%

Full breach record for Nakawatase & Kaminsky, CPAs, LLP →

Nakawatase & Kaminsky, CPAs, LLP experienced a cyber incident where an intruder hacked into their Lacerte tax system between October 31 and November 8, 2016. The breach compromised personal and financial information of clients, including names, addresses, SSNs, and bank account numbers. Four tax returns were fraudulently filed. The firm engaged forensic investigators, notified law enforcement and tax authorities, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 1, 2017 → Notified Feb 3, 201733d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 62 days

discovery → filing · 5 weeks / 33 days

Oct 31, 2016

Begins

Jan 1, 2017

Discovered

Feb 3, 2017

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Nakawatase & Kaminsky, CPAs, LLP
norm: nakawatase kaminsky cpas

Name: Nakawatase & Kaminsky, CPAs, LLP
norm: nakawatase kaminsky cpas
Industry: Professional Servicesllm

Discovered: Jan 1, 2017
Breach occurred: Oct 31, 2016 – Nov 8, 2016
Undetected for: 62 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified the San Diego County Sheriff’s DepartmentNotified the Federal Bureau of Investigation’s San Diego field officeNotified the Internal Revenue Service Treasury Inspector GeneralNotified the Franchise Tax Board’s fraud unit
Initial access: exploit_public_facing

During the incident: Engaged Navigant to assist with the investigation
Notified the San Diego County Sheriff’s Department
Notified the Federal Bureau of Investigation’s San Diego field office
Notified the Internal Revenue Service Treasury Inspector General
Notified the Franchise Tax Board’s fraud unit
Offering 12 months of complimentary credit monitoring through AllClearID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: CA 60-day OK · 33d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 1, 2017
→ Notified: Feb 3, 2017
33d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 1, 2017 → Notified: Feb 3, 2017	33d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66191
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 3, 2017
Raw hash: b7f236a05c6d6f4ab6f5b9cf68938f818e097b5137c77991953ffda5c7e9fdb3

Reporting entityNakawatase & Kaminsky, CPAs, LLP

Victim entityNakawatase & Kaminsky, CPAs, LLP

Incidentdiscovered Jan 1, 2017

Stated responseEngaged Navigant to assist with the investigation

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov