Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedData ExfiltratedMulti-Stage ChainDelayed DiscoveryPIILowContained
Todd & Weld LLP
bd_5db4a554098b591b · schema v1 · pii pii-v1
Full breach record for Todd & Weld LLP →Todd & Weld LLP, a Boston-based law firm, detected unauthorized access to two employee email accounts as a result of a phishing email. Unauthorized access occurred between September 30 and October 23, 2024. Discovery of compromised personal information (names and additional PII) was made on January 22, 2025. Total affected individuals: 174, including 2 Maine residents. IDX credit monitoring offered for 12 months.
Maine clockDiscovered Jan 22, 2025 → Filed with AG Mar 26, 202563d ⏱ ME AG >30d9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_62affb528f5760beMaryland State AGfiled 2026-04-23(393d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0c0104a0-3488-4fe2-a279-c813322c8836.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 26, 2025
- Raw hash
- 72a60001e00f9de8548a4ceca34ab04110c7ff4684f5421de5625f7ab3681963
Reporting entity
- Name
- Todd & Weld LLPnorm: todd weld
- Industry
- Legal Services
Victim entity
- Name
- Todd & Weld LLPnorm: todd weld
- Industry
- Legal Services
- Industry
- Professional Servicesllm
Incident
- Discovered
- Jan 22, 2025
- Materiality determined
- —
- Notification sent
- Mar 26, 2025
- Affected individuals
- 2
- Data types
- PII
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566 PhishingT1078 Valid Accounts
- Threat actor
- External
- Initial access
- phishing_link
Compliance
- Time to disclose
- 9 weeks(63 days from discovery to filing)
- Compliance flags
- ME AG >30d · 63dME resident >60d · 63d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jan 22, 2025→ Filed with AG: Mar 26, 202563d 30 days (soft) ME AG >30d Maine Discovered: Jan 22, 2025→ Notified: Mar 26, 202563d 60 days (analyst band; statutory cap is 30 days) ME resident >60d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.