MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedRansom DemandedGovernment IDHealth (basic)PIIMediumContained

Lightfoot, Franklin & White LLC

bd_51c7b376f5d05cf5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 17, 2021

Filed

Jun 16, 2021

To disclose

9 weeks

Affected

17state residents only

Linked

5 filings

Confidence

66%

Full breach record for Lightfoot, Franklin & White LLC →2 incidents on file

Lightfoot, Franklin & White, LLC notified Montana and other states of a ransomware incident discovered on April 17, 2021. Unauthorized access occurred to client case files containing SSNs, government IDs, and health information. The firm contained the incident, engaged forensic consultants, and confirmed data destruction by the attacker. Affected individuals were offered Experian IdentityWorks monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 9 weeks / 60 days

Apr 17, 2021

Discovered

Jun 16, 2021

Filed

vs. sector median

10 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_40a7b26f5070137c2021-06-16Verified
Maine State AGbd_572e92b96b15f33c2021-06-16Verified
Indiana State AGbd_6b734de6812539322021-06-16Verified
New Hampshire State AGbd_4669d96fd310ed642021-06-17 · +1dVerified

Name: Lightfoot, Franklin & White LLC
norm: lightfoot franklin white
Domain: lightfootlaw.com

Name: Lightfoot, Franklin & White LLC
norm: lightfoot franklin white
Domain: lightfootlaw.com
Industry: Professional Servicesllm

Discovered: Apr 17, 2021
Materiality determined: —
Notification sent: Jun 16, 2021
Affected individuals: 17state-resident count only
Data types: Government IDHealth (basic)PII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement
Initial access: valid_credentials

During the incident: Took immediate steps to contain the incident
Engaged outside consultants to conduct an investigation
Notified law enforcement
Reached a resolution and have received confirmation from the third party that the compromised information was destroyed
Engaged in an extensive review to identify the individuals whose personal information was compromised
Enhancing the security of our systems and the data entrusted to us
Implementing endpoint security software on our systems
Emphasizing employee education and training
Working with an independent cybersecurity firm to review and enhance our security policies and procedures
Engaged a service provider to conduct both public and dark web monitoring
Changes made: Implementing endpoint security software on our systems
Emphasizing employee education and training
Working with an independent cybersecurity firm to review and enhance our security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGJun 16 · first

Maine State AGJun 16 · first

Indiana State AGJun 16 · first

Montana State AGJun 16 · first · this page

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/lightSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 16, 2021
Raw hash: 2d35d0b9d4ad600bad789a4bfbbb240855ed57ae91239033dcc3745d4f6b58c5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLightfoot, Franklin & White LLC

Victim entityLightfoot, Franklin & White LLC

Incidentdiscovered Apr 17, 2021

Stated responseTook immediate steps to contain the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov