MalwareFinancial ServicesProfessional ServicesFinanceRansomwareRansom DemandedData ExfiltratedData EncryptedSupply Chain (3P Vendor)Identity (basic)Government IDFinancial accountPIIMediumContained

PKF O'CONNOR DAVIES ADVISORY, LLC

bd_69f151ab9e4dcd85 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 3, 2020

Filed

Apr 2, 2021

To disclose

17 weeks

Affected

8state residents only

Linked

4 filings

Confidence

62%

Full breach record for PKF O'CONNOR DAVIES ADVISORY, LLC →3 incidents on file

PKF O'Connor Davies LLP notified Montana investors of a ransomware incident affecting third-party host Netgain Technology, LLC. The threat actor gained access on Nov 8, 2020, exfiltrated data, and encrypted files starting Dec 3, 2020. Compromised data included names, SSNs, financial accounts, and tax documents. PKFOD engaged forensic experts and offered credit monitoring and fraud services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 25 days

discovery → filing · 17 weeks / 120 days

Nov 8, 2020

Begins

Dec 3, 2020

Discovered

Apr 2, 2021

Filed

vs. sector median

+8 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_6ebd4187b44ee17f2021-04-02Verified
Massachusetts State AGbd_9a717a1954f0705b2021-04-02Verified
New Hampshire State AGbd_ea6d1ae607add3662021-04-02Verified

Name: PKF O'CONNOR DAVIES ADVISORY, LLC
norm: pkf o connor davies advisory

Name: PKF O'CONNOR DAVIES ADVISORY, LLC
norm: pkf o connor davies advisory
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Dec 3, 2020
Breach occurred: Nov 8, 2020 – Dec 3, 2020
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 24, 2020
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Netgain Technology, LLC

During the incident: Netgain took its systems offline
Netgain engaged leading cybersecurity professionals to assist with remediation and forensics investigation
PKFOD hired an independent, third-party team of cybersecurity experts to verify findings
Offering complimentary services provided by CyberScout for fraud assistance and remediation
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score/Cyber Monitoring services at no charge for 24 months
Providing proactive fraud assistance and a $1,000,000 insurance reimbursement policy
Changes made: Netgain deployed threat-detecting tools across its environment
Netgain rotated all user credentials
Netgain ran scripts to ensure all backups were clean prior to restoring infected systems
Netgain brought systems online once deemed free of infection or lingering malware
Vulnerability has been patched
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(120 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGApr 2 · first

Massachusetts State AGApr 2 · first

New Hampshire State AGApr 2 · first

Montana State AGApr 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/PKF-Notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2021
Raw hash: a0459dcf22aace17ca622b57daf64893bbd14d8bb825c0b56ffcab6b600f0abe

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPKF O'CONNOR DAVIES ADVISORY, LLC

Victim entityPKF O'CONNOR DAVIES ADVISORY, LLC

Incidentdiscovered Dec 3, 2020

Stated responseNetgain took its systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov