HackingProfessional ServicesFinancial ServicesProfessional ServicesCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

Williams Scarborough Gray, LLP

bd_5528ae442f52a947 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2024

Filed

May 20, 2025

To disclose

24 weeks

Affected · nationwide

9731 in this filing

Linked

4 filings

Confidence

65%

Full breach record for Williams Scarborough Gray, LLP →

Williams Scarborough Gray, LLP reported an external system breach (hacking) occurring between Nov 30 and Dec 4, 2024. Unauthorized access resulted in the exfiltration of names, SSNs, and financial account numbers. 973 individuals were affected, including 1 Maine resident. Notices were sent on May 20, 2025, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 30, 2024 → Filed with AG May 20, 2025171d ⏱ ME AG >30d24 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 24 weeks / 171 days

Nov 30, 2024

Begins

Nov 30, 2024

Discovered

May 20, 2025

Filed

vs. sector median

+5 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_32a1b08ed976ca602025-05-20Verified
Massachusetts State AGbd_54c978cdf7092d332025-05-20Verified
Nebraska State AGbd_dab5f594d5cdac772025-05-20Verified

Name: Octillo Law
norm: octillo law

Name: Williams Scarborough Gray, LLP
norm: williams scarborough gray
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: Nov 30, 2024
Breach occurred: Nov 30, 2024 – Dec 4, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 20, 2025
Affected individuals: 973state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue ServiceNotified state tax authorities
Initial access: exploit_public_facing

During the incident: Changing passwords
Installing new firewalls
Restoring systems from backups
Notifying the Internal Revenue Service and state tax authorities
Engaging data security and privacy professionals to assist
Added technical security protections on top of existing protections
Implementing additional technical safeguards
Offering 12 month complimentary credit monitoring and call center service
Changes made: Installing new firewalls
Implementing additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(171 days from discovery to filing)
Compliance flags: ME AG >30d · 171dME resident >60d · 171d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 30, 2024
→ Filed with AG: May 20, 2025
171d 30 days (soft) ME AG >30d
Maine
Discovered: Nov 30, 2024
→ Notified: May 20, 2025
171d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 30, 2024 → Filed with AG: May 20, 2025	171d	30 days (soft)	ME AG >30d
Maine	Discovered: Nov 30, 2024 → Notified: May 20, 2025	171d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 20 · first

Massachusetts State AGMay 20 · first

Nebraska State AGMay 20 · first

Maine State AGMay 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/245ee80a-4059-4ccb-901d-2c028a29e815.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 20, 2025
Raw hash: fd9052d6b3be2a31fc99930ce912f7c50044aaeec248f3ad227ad048b2baaaec

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOctillo Law

Victim entityWilliams Scarborough Gray, LLP

Incidentdiscovered Nov 30, 2024

Stated responseChanging passwords

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov