Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedTargetedPIIIdentity (basic)LowContained

Shaheen & Gordon, P.A.

bd_5d9167ac7251154e · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 17, 2024

Filed

Oct 11, 2024

To disclose

25 weeks

Affected

79state residents only

Linked

3 filings

Confidence

66%

Full breach record for Shaheen & Gordon, P.A. →

Shaheen & Gordon, P.A. notified the NH AG of a phishing incident on April 16, 2024, where an employee's credentials were compromised. Access was detected on April 17 and terminated. 79 NH residents' PII may have been accessed. Notices and credit monitoring were offered on Oct 3, 2024.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 25 weeks / 177 days

Apr 16, 2024

Begins

Apr 17, 2024

Discovered

Oct 11, 2024

Filed

vs. sector median

+8 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_3c75d4b574da84e32024-10-16 · +5dVerified
Maine State AGbd_68db8e7fb5a0ce882024-10-31 · +20dVerified

Name: Shaheen & Gordon, P.A.
norm: shaheen gordon
Domain: shaheengordon.com
Industry: professional_services

Name: Shaheen & Gordon, P.A.
norm: shaheen gordon
Domain: shaheengordon.com
Industry: professional_services
Industry: Professional Servicesllm

Discovered: Apr 17, 2024
Breach occurred: Apr 16, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 3, 2024
Affected individuals: 79state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: phishing_link

During the incident: Access was terminated immediately
Worked closely with internal IT department and an outside IT consultant
Ensured controls are in place to limit the chances of this occurring again
Mailed notices to the seventy-nine (79) individuals
Offered credit monitoring at no cost to the individuals
Reevaluate pertinent processes, policies and technology
Enhancing cyber security employee training
Investing in new technology
Continue to monitor our systems for evidence of further suspicious activity
Changes made: Enhancing cyber security employee training
Investing in new technology
Reevaluate pertinent processes, policies and technology to improve how we protect the privacy of the data we collect
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(177 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGOct 11 · first · this page

Massachusetts State AG+5d

Maine State AG+20d

Pattern: first filing Oct 11 (NH), last Oct 31 (ME) — a 20-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/shaheen-gordon-attorneys-20241011.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 11, 2024
Raw hash: 16bf98c8e6192ce8680db9b35adacc96aac297bf15aca322c6794a930f41f2a7

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityShaheen & Gordon, P.A.

Victim entityShaheen & Gordon, P.A.

Incidentdiscovered Apr 17, 2024

Stated responseAccess was terminated immediately

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov