HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

McElroy, Deutsch, Mulvaney & Carpenter LLP

bd_6da1ae289ac34596 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Apr 3, 2025

Filed

Dec 19, 2025

To disclose

—

Affected

3state residents only

Linked

6 filings

Confidence

66%

Full breach record for McElroy, Deutsch, Mulvaney & Carpenter LLP →

McElroy, Deutsch, Mulvaney & Carpenter LLP (MDMC) reported a cyberattack to Nebraska regulators. Unauthorized access to MDMC systems occurred between March 28 and April 1, 2025. MDMC discovered suspicious activity on April 3, 2025, and confirmed on December 4, 2025, that personal information (names and Social Security numbers) of approximately three Nebraska residents was accessed. MDMC notified federal law enforcement, provided 12 months of credit monitoring via Epiq, and began notifying affected individuals on December 19, 2025. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

Mar 28, 2025

Begins

Apr 3, 2025

Discovered

Dec 19, 2025

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_698f1a0d029620162025-12-19Verified
New Hampshire State AGbd_bd3f74df05a359e32025-12-19Verified
Maine State AGbd_efd18d3b3c3e05362025-12-19Candidate
New Hampshire State AGbd_03b000a29a602b0c2026-03-12 · +83dCandidate

Show 1 more filing ↓up to 83d gap

Maine State AGbd_df428c93170c98cf2026-03-12 · +83dVerified

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Professional Servicesllm

Discovered: Apr 3, 2025
Breach occurred: Mar 28, 2025 – Apr 1, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Providing written notice of this incident to relevant state regulators, as necessary
Initial access: exploit_public_facing

During the incident: Notified federal law enforcement regarding the event
Providing access to credit monitoring services for twelve (12) months, through Epiq, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Reviewing its policies and procedures to reduce the likelihood of similar future events
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Indiana State AGDec 19 · first

New Hampshire State AGDec 19 · first

Maine State AGDec 19 · first

Nebraska State AGDec 19 · first · this page

New Hampshire State AG+83d

Maine State AG+83d

Pattern: first filing Dec 19 (IN), last Mar 12 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/e336d989-8268-4866-823e-8ca06dc7a25c.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: 5a390e939b1f177989729e4e37811fe9cacda731e1dbadd4ab833c91a97cadec

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Victim entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Incidentdiscovered Apr 3, 2025

Stated responseNotified federal law enforcement regarding the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov