Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)PIILowContained

Todd & Weld LLP

bd_5db4a554098b591b · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 28, 2025

Filed

Mar 26, 2025

To disclose

26 days

Affected · nationwide

1742 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Todd & Weld LLP →2 incidents on file

Todd & Weld LLP reported a phishing incident affecting 174 individuals, including 2 Maine residents. Unauthorized access to two employee email accounts occurred between September 30 and October 23, 2024. The breach was discovered on February 28, 2025, and notifications were sent on March 26, 2025. Impacted data included names and personal identifiers. IDX provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 28, 2025 → Filed with AG Mar 26, 202526d ✓ ME AG ≤30d26 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 151 days

discovery → filing · 26 days

Sep 30, 2024

Begins

Feb 28, 2025

Discovered

Mar 26, 2025

Filed

vs. sector median

16 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maryland State AGbd_62affb528f5760be2026-04-23 · +393dVerified

Name: Todd & Weld LLP
norm: todd weld

Name: Todd & Weld LLP
norm: todd weld
Industry: Professional Servicesllm

Discovered: Feb 28, 2025
Breach occurred: Sep 30, 2024 – Oct 23, 2024
Undetected for: 151 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2025
Affected individuals: 174state + nationwide
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Forensic investigation confirmed unauthorized access
Extensive forensic investigation and comprehensive manual review of the affected data
Offering complimentary identity theft protection services through IDX
Changes made: Review physical safeguards
Address employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: ME AG ≤30d · 26d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 28, 2025
→ Filed with AG: Mar 26, 2025
26d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 28, 2025 → Filed with AG: Mar 26, 2025	26d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGMar 26 · first · this page

Maryland State AG+393d

Pattern: first filing Mar 26 (ME), last Apr 23 (MD) — a 393-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0c0104a0-3488-4fe2-a279-c813322c8836.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2025
Raw hash: 72a60001e00f9de8548a4ceca34ab04110c7ff4684f5421de5625f7ab3681963

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityTodd & Weld LLP

Victim entityTodd & Weld LLP

Incidentdiscovered Feb 28, 2025

Stated responseCommenced a prompt and thorough investigation

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov