Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountPCIMediumContained

Grandizio Wilkins Little & Matthews, LLP

bd_68e41a6065c14fc1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 7, 2021

Filed

Jan 14, 2022

To disclose

32 weeks

Affected

22state residents only

Linked

6 filings

Confidence

67%

Full breach record for Grandizio Wilkins Little & Matthews, LLP →

Grandizio Wilkins Little & Matthews, LLP (GWLM), an accounting firm, notified the New Hampshire Attorney General of a data security incident affecting approximately 22 NH residents. On June 7, 2021, GWLM discovered unauthorized access to an employee's email account, likely via phishing. The incident potentially exposed names, SSNs, medical info, driver's license info, financial account info, and payment card data. GWLM engaged forensic experts, reported to the FBI, and sent notification letters on January 14, 2022, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 221 days

Jun 7, 2021

Discovered

Jan 14, 2022

Filed

vs. sector median

+13 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_249036498f8c74be2022-01-14Verified
Delaware State AGbd_35b3a7fba97c5d332022-01-14Candidate
Indiana State AGbd_440a17d40b4e2e3a2022-01-14Verified
Maine State AGbd_628b4a53f2a6ffd72022-01-14Verified by operator

Show 1 more filing ↓up to 28d gap

Delaware State AGbd_2912bfae254577842021-12-17 · +28dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Grandizio Wilkins Little & Matthews, LLP
norm: grandizio wilkins little matthews
Industry: Professional Servicesllm

Discovered: Jun 7, 2021
Materiality determined: —
Notification sent: Jan 14, 2022
Affected individuals: 22state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial accountPCI
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Reported the incident to the Federal Bureau of Investigation (FBI)
Initial access: phishing_link

During the incident: Engaged cybersecurity experts to determine if information had been affected
Launched a forensics investigation to determine the source and scope of the compromise
Reported the incident to the Federal Bureau of Investigation (FBI)
Implemented additional security measures to further harden our digital environment
Revised their data retention policy
Notifying the affected individuals and providing them with steps they can take to protect their personal information
Enrolling in complimentary identity monitoring services
Changes made: Implemented additional security measures to further harden our digital environment
Revised their data retention policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(221 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Delaware State AGDec 17 · first

Massachusetts State AG+28d

Delaware State AG+28d

Indiana State AG+28d

Maine State AG+28d

New Hampshire State AG+28d · this page

Pattern: first filing Dec 17 (DE), last Jan 14 (NH) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/grandizio-wilkins-little-matthews-20220114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 14, 2022
Raw hash: f610b0e960269e0f3f4303368e4565c1c6719ba39c661dcdaaf88588f34ec797

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityGrandizio Wilkins Little & Matthews, LLP

Incidentdiscovered Jun 7, 2021

Stated responseEngaged cybersecurity experts to determine if information had been affected

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov