HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Fishman, Larsen & Callister, P.C.

bd_57b42dbddc149528 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 9, 2025

Filed

Feb 12, 2026

To disclose

35 weeks

Affected

Not disclosed

Linked

4 records

Confidence

64%

Full breach record for Fishman, Larsen & Callister, P.C. →

Fishman, Larsen & Callister, P.C. experienced unauthorized access to personal information on or about June 8, 2025, discovered on June 9, 2025. The incident involved names and likely Social Security numbers. The firm engaged cybersecurity experts, notified the FBI, and is offering credit monitoring services to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 9, 2025 → Notified Feb 11, 2026247d ✗ CA 60-day late35 weeks discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 35 weeks / 248 days

Jun 8, 2025

Begins

Jun 9, 2025

Discovered

Feb 12, 2026

Filed

vs. sector median

+16 wks slower

This filing is one of 4 records about the same incident.View merged incident

A leak claim by everest about this victim was first seen 233 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Siteeverestbd_8c63bf0e689e54402025-07-11 · +216dVerified
Leak Siteeverestbd_433a14f5496353072025-06-10 · +247dVerified

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_42efd8c4682636d62026-02-12Candidate

Name: Fishman, Larsen & Callister, P.C.
norm: fishman larsen callister
Domain: fishmanlaw.com

Name: Fishman, Larsen & Callister, P.C.
norm: fishman larsen callister
Domain: fishmanlaw.com
Industry: Professional Servicesllm

Discovered: Jun 9, 2025
Breach occurred: Jun 8, 2025 – Jun 9, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Feb 11, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the Federal Bureau of Investigation

During the incident: Took steps to secure our network
Engaged cybersecurity experts to conduct an investigation
Engaged a third-party vendor to conduct a comprehensive review of the affected data
Notified the Federal Bureau of Investigation and will cooperate with any resulting investigation
Changes made: Implemented measures to enhance our network security to minimize the risk of a similar incident occurring in the future
Offering the opportunity to enroll in complimentary credit monitoring and identity theft protection services, including a $1,000,000 identity theft insurance policy, at no charge to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 35 weeks(248 days from discovery to filing)
Compliance flags: CA 60-day late · 247dLeak >180dCA AG copy ≤15d · 1d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 9, 2025
→ Notified: Feb 11, 2026
247d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
California
Consumers notified: Feb 11, 2026
→ AG copy submitted: Feb 12, 2026
1d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 9, 2025 → Notified: Feb 11, 2026	247d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late
California	Consumers notified: Feb 11, 2026 → AG copy submitted: Feb 12, 2026	1d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGFeb 12 · first

California State AGFeb 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-618583
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 12, 2026
Raw hash: 1673ddc56338e87c1d89142e3bd3baa71fe4b34083ccc101065ce53e9002d51b

Linked disclosures

Ransomware claims (2)

Regulatory filings (1) · sorted by filing gap

Reporting entityFishman, Larsen & Callister, P.C.

Victim entityFishman, Larsen & Callister, P.C.

Incidentdiscovered Jun 9, 2025

Stated responseTook steps to secure our network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov