HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

Gumbiner Savett Inc.

bd_588482623508fbe0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 1, 2021

Filed

Oct 28, 2021

To disclose

17 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Gumbiner Savett Inc. →

BPM LLP notified California residents that personal information from Gumbiner Savett Inc., acquired by BPM, may have been accessed by an unknown third party between November 2020 and September 2021. Affected data includes names, addresses, phone numbers, Social Security numbers, and tax IDs. BPM retained security experts, contained the incident, and offered 12 months of identity monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 1, 2021 → Notified Oct 27, 2021118d ✗ CA 60-day late17 weeks discovery → filing

Incident timeline

undetected · 242 days

discovery → filing · 17 weeks / 119 days

Nov 1, 2020

Begins

Jul 1, 2021

Discovered

Oct 28, 2021

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: BPM LLP
norm: bpm

Name: Gumbiner Savett Inc.
norm: gumbiner savett
Industry: Professional Servicesllm

Discovered: Jul 1, 2021
Breach occurred: Nov 1, 2020 – Sep 20, 2021
Undetected for: 242 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 27, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External

During the incident: Initiated an investigation
Retained outside security experts to assist in investigating, containing, and remediating the incident
Continued to monitor the situation
Offering complimentary access to Experian IdentityWorks for twelve months
Changes made: Maintain safeguards to help protect the security of personal information
Ongoing review of the security of legacy systems
Undertaking measures to further secure personal information
Continuously monitoring processes to prevent similar incidents in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(119 days from discovery to filing)
Compliance flags: CA 60-day late · 118d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 1, 2021
→ Notified: Oct 27, 2021
118d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 1, 2021 → Notified: Oct 27, 2021	118d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-547007
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 28, 2021
Raw hash: 9144192275253dceb0b81d35430e85de84c7f196e7b488771efedc459f1e0634

Reporting entityBPM LLP

Victim entityGumbiner Savett Inc.

Incidentdiscovered Jul 1, 2021

Stated responseInitiated an investigation

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov