UnknownProfessional ServicesProfessional ServicesCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

Douglas M Smith & Co, CPAs

bd_7363ff8724b2e114 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 31, 2020

Filed

Jul 7, 2020

To disclose

14 weeks

Affected

Confidence

64%

Full breach record for Douglas M Smith & Co, CPAs →2 incidents on file

Douglas M. Smith & Co. CPA notified clients that between March 25 and April 1, 2020, 32 tax returns were rejected because fraudulent returns had already been filed using their Social Security Numbers. The firm found no evidence of unauthorized access to its own systems or malware. The incident involved the compromise of SSNs, names, addresses, and dates of birth for 32 individuals. The firm engaged forensic investigators, notified law enforcement (IRS, Secret Service, FBI, Fresno Police), and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 14 weeks / 98 days

Mar 25, 2020

Begins

Mar 31, 2020

Discovered

Jul 7, 2020

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed32 affectedView incident

Name: Douglas M Smith & Co, CPAs
norm: douglas m smith co cpas

Name: Douglas M Smith & Co, CPAs
norm: douglas m smith co cpas
Industry: Professional Servicesllm

Discovered: Mar 31, 2020
Breach occurred: Mar 25, 2020 – Apr 1, 2020
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 32nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unknown
Threat actor: ExternalFinancial
Regulator citations: Reported to IRSReported to Secret ServiceReported to Fresno PoliceReported to FBI

During the incident: Reported this incident to the IRS, Secret Service, Fresno Police and FBI
Retained forensic investigators to conduct an investigation
Retained legal counsel to conduct an investigation
Directed the IRS to flag accounts to prevent anyone other than our office from filing a return
Re-filing impacted returns in paper format
Providing one year of complimentary credit monitoring, fraud monitoring, and Identity Theft Insurance
Hired a new IT and cybersecurity firm to manage all security going forward
Implemented global password changes
Conducted ongoing malware scans and network monitoring
Changes made: Hired a new IT and cybersecurity firm to manage all security going forward
Implemented global password changes
Conducted ongoing malware scans and network monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(98 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-191767
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2020
Raw hash: 61e6066405572b7d47d2498d4a2bfa8af666e168dc5704b66c233dea94932a01

Reporting entityDouglas M Smith & Co, CPAs

Victim entityDouglas M Smith & Co, CPAs

Incidentdiscovered Mar 31, 2020

Stated responseReported this incident to the IRS, Secret Service, Fresno Police and FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov