HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

The Smith and Oby Company

bd_6c8198fee11d6d5a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2021

Filed

Apr 22, 2021

To disclose

4 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for The Smith and Oby Company →

Smith and Company, a CPA firm, notified clients that their Electronic Filing ID with the IRS was compromised via their third-party software provider, Intuit, on March 23, 2021. The incident potentially exposed client tax data including names, addresses, dates of birth, SSNs, and bank account numbers. Smith and Company ceased transmissions, obtained a new EFIN, and engaged cybersecurity experts. No specific count of affected individuals was disclosed in the notice.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 23, 2021 → Notified Apr 22, 202130d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

discovery → filing · 4 weeks / 30 days

Mar 23, 2021

Begins

Mar 23, 2021

Discovered

Apr 22, 2021

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: The Smith and Oby Company
norm: the smith and oby

Name: The Smith and Oby Company
norm: the smith and oby
Industry: Professional Servicesllm

Discovered: Mar 23, 2021
Breach occurred: Mar 23, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 22, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified the IRS
Third party: via Intuit
Initial access: supply_chain

During the incident: Notified the IRS directly of the fraudulent activity
Ceased the transmission of all returns potentially impacted
Worked with Intuit’s Fraud Department to reapply for a new, secure Electronic Filing ID number
Working with expert Information Technology organization and a leading Cyber Security Firm
Upgrading our servers
Reinforcing our firewalls
Administering vulnerability scans
Strengthening internal security protocols
Offering 12 months of complimentary identity theft prevention and mitigation services
Changes made: Upgrading our servers
Reinforcing our firewalls
Administering vulnerability scans
Strengthening internal security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 23, 2021
→ Notified: Apr 22, 2021
30d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 23, 2021 → Notified: Apr 22, 2021	30d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-540240
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 22, 2021
Raw hash: 3157ad80b5d57948b0baf309fa998825b536d7f7227a6d0c434e3146da37767b

Reporting entityThe Smith and Oby Company

Victim entityThe Smith and Oby Company

Incidentdiscovered Mar 23, 2021

Stated responseNotified the IRS directly of the fraudulent activity

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov