MalwareProfessional ServicesProfessional ServicesRansomwareCapture Stored DataData EncryptedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Fitzgerald, DePietro & Wojnas CPAs, P.C.

bd_71788bca92fc6178 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2024

Filed

Oct 9, 2024

To disclose

16 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Fitzgerald, DePietro & Wojnas CPAs, P.C. →

Fitzgerald, DePietro & Wojnas CPAs, P.C. experienced a ransomware incident discovered on June 19, 2024. A threat actor gained access to the network, encrypted files, and exfiltrated tax documents and personal information including names, SSNs, DOBs, and financial account data. The firm severed access, reset passwords, restored backups, and engaged forensic investigators. Identity protection services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday16 weeks discovery → filing

Incident timeline

discovery → filing · 16 weeks / 112 days

Jun 19, 2024

Discovered

Oct 9, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitemedusabd_5f353c840e46a2f02024-06-19 · +112dVerified by operator
Leak Sitemedusabd_179daa6a503f51a42024-06-17 · +113dVerified by operator

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_98138fd2f93516822024-10-09Verified
Massachusetts State AGbd_c175690325b7fafb2024-10-05 · +4dVerified by operator
Pressmedusabd_8741d25aa95b9e272024-06-19 · +112dCandidate

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net
Industry: Professional Servicesllm

Discovered: Jun 19, 2024
Materiality determined: —
Notification sent: Sep 26, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External

During the incident: Severed the threat actor’s access to our networks
Reset IT passwords
Hardened our network
Restored our files from backups
Deployed software to ensure that the threat actor was out of our system
Engaged cybersecurity counsel and a forensics firm to guide us through the Incident response process
Offering identity theft protection services through IDX, A ZeroFox Company
Changes made: Hardened our network
Deployed software to ensure that the threat actor was out of our system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

PressJun 19 · first

Massachusetts State AG+108d

Montana State AG+112d

Vermont State AG+112d · this page

Pattern: first filing Jun 19, last Oct 9 (VT) — a 112-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-10-09-fitzgerald-depietro-wojnas-cpas-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2024
Raw hash: 5d68b35ec0079a0bfcd55996cbe4ab6dba665bc479302fac615561653904a262

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Victim entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Incidentdiscovered Jun 19, 2024

Stated responseSevered the threat actor’s access to our networks

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov