HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Davidoff Hutcher & Citron LLP

bd_56edfa3d945c42d0 · schema v1 · pii pii-v1

Severity

Low

Discovered

Aug 18, 2023

Filed

Aug 20, 2024

To disclose

12 months

Affected

22state residents only

Linked

8 filings

Confidence

65%

Full breach record for Davidoff Hutcher & Citron LLP →2 incidents on file

Davidoff Hutcher & Citron LLP notified individuals of a data breach where an unauthorized party accessed the network between Jan 12 and Aug 18, 2023. The attacker may have exfiltrated names and other personal info. DHC detected the breach on Aug 18, 2023, contained it, and engaged external cybersecurity professionals. Affected individuals are offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 218 days

discovery → filing · 12 months / 368 days

Jan 12, 2023

Begins

Aug 18, 2023

Discovered

Aug 20, 2024

Filed

vs. sector median

+34 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_4d665d6a92b5ce582023-08-21 · +365dVerified by operator

Regulatory filings (6) · sorted by filing gap

California State AGbd_f03d3a1a868c42862024-08-20Verified by operator
Vermont State AGbd_71369198ffef49ce2024-08-21 · +1dVerified
Massachusetts State AGbd_9beb0a4154edab632024-08-21 · +1dVerified
Indiana State AGbd_cd245bb64f6273b42024-08-19 · +1dVerified by operator

Show 2 more filings ↓up to 11d gap

New Hampshire State AGbd_8c5c00a3b5bf96f72024-08-26 · +6dVerified by operator
Maine State AGbd_3b37ea23e9b37e6b2024-08-09 · +11dVerified

Name: Davidoff Hutcher & Citron LLP
norm: davidoff hutcher citron

Name: Davidoff Hutcher & Citron LLP
norm: davidoff hutcher citron
Industry: Professional Servicesllm

Discovered: Aug 18, 2023
Breach occurred: Jan 12, 2023 – Aug 18, 2023
Undetected for: 218 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2024
Affected individuals: 22state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Contained the threat by disabling all unauthorized access to our network
Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Offering a complimentary 12 month membership of Single Bureau Credit Monitoring
Providing you with proactive fraud assistance
Changes made: Continually evaluate and modify our practices to enhance the security and privacy of your personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(368 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Maine State AGAug 9 · first

Indiana State AG+10d

California State AG+11d

Montana State AG+11d · this page

Vermont State AG+12d

Massachusetts State AG+12d

New Hampshire State AG+17d

Pattern: first filing Aug 9 (ME), last Aug 26 (NH) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1606.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2024
Raw hash: 728f53797dfe1ae623cf1e3db9f1c2265f705802918bf2e68811b6cc44789c46

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityDavidoff Hutcher & Citron LLP

Victim entityDavidoff Hutcher & Citron LLP

Incidentdiscovered Aug 18, 2023

Stated responseContained the threat by disabling all unauthorized access to our network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov