HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Calibre CPA Group

bd_66ae17adab8607d6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 16, 2019

Filed

Oct 10, 2019

To disclose

25 weeks

Affected

983state residents only

Linked

6 filings

Confidence

70%

Full breach record for Calibre CPA Group →2 incidents on file

Supplemental notice for Calibre CPA Group regarding unauthorized access to employee email accounts and a server between March 11 and May 7, 2019. Incident discovered April 16, 2019. 983 Washington residents affected, including names, SSNs, and financial account info. Notices sent starting August 26, 2019. Remediation included MFA and forensic review.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 25 weeks / 177 days

Mar 11, 2019

Begins

Apr 16, 2019

Discovered

Oct 10, 2019

Filed

vs. sector median

+8 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_b7b0c8592bb421c42019-09-27 · +13dVerified
New Hampshire State AGbd_c9b305f10e4fa56f2019-09-10 · +30dVerified
California State AGbd_469bb67cd6efc5df2019-09-09 · +31dVerified
Massachusetts State AGbd_80543e862f2dd7672019-08-26 · +45dCandidate

Show 1 more filing ↓up to 45d gap

Montana State AGbd_fda5cc6a136f7ac92019-08-26 · +45dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Calibre CPA Group
norm: calibre cpa
Industry: Professional Servicesllm

Discovered: Apr 16, 2019
Breach occurred: Mar 11, 2019 – May 7, 2019
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 26, 2019
Affected individuals: 983state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Notified law enforcement
Provided relevant regulatory notices
Secured the services of Kroll to provide identity monitoring services
Resetting passwords for Calibre email accounts
Changes made: Implementation of dual factor authentication to gain access to our systems
Scans of emails automatically directed to system drives instead of emails
Additional employee training
Vulnerability studies
Specific cyber-security comprehensive evaluations
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(177 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGAug 26 · first

Montana State AGAug 26 · first

California State AG+14d

New Hampshire State AG+15d

HHS OCR+32d

Washington State AG+45d · this page

Pattern: first filing Aug 26 (MA), last Oct 10 (WA) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10513.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2019
Raw hash: 0f8be257978dea9459f17b0f44ff47adf66e4004612bb2d7b290193bbd2eda63

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCalibre CPA Group

Incidentdiscovered Apr 16, 2019

Stated responseNotified law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com