DisclosureLens
Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedAuthenticationFinancial accountIdentity (basic)Government IDPHIHealth (basic)MediumContained

Fuller & Fuller

bd_6dc21e6712c7b67e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 15, 2021

Filed

Jul 1, 2022

To disclose

28 weeks

Affected

704state residents only

Confidence

70%
Full breach record for Fuller & Fuller →

Fuller & Fuller, a legal services firm, disclosed a phishing incident affecting 704 Washington residents. Unauthorized access to an employee email account occurred between Oct 18 and Dec 11, 2021. Compromised data included names and government IDs. The firm engaged outside cybersecurity professionals and offered 12 months of credit monitoring.

Washington clock✗ WA AG >90d28 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 58 days
discovery → filing · 28 weeks / 198 days

Oct 18, 2021

Begins

Dec 15, 2021

Discovered

Jul 1, 2022

Filed

vs. sector median

+9 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,408 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.