HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumResolved

Peabody & Arnold LLP

bd_745a05f98594edf4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jan 29, 2021

To disclose

—

Affected

128state residents only

Linked

5 filings

Confidence

64%

Full breach record for Peabody & Arnold LLP →

Peabody & Arnold LLP, a law firm, reported a supplemental breach notification to the NH Attorney General. An unauthorized person accessed an employee's email account between May 21 and May 27, 2020. The incident affected 128 New Hampshire residents (97 initially notified, 31 additional client-related residents). Data exposed included names, dates of birth, Social Security numbers, driver's license numbers, financial account numbers, and diagnosis/clinical information. The firm engaged a cybersecurity firm, concluded its investigation, and implemented remediation measures including enterprise-wide two-factor authentication and disabling legacy email protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

May 21, 2020

Begins

Jan 29, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_bc8faef067c8a1902021-01-28 · +1dVerified
New Hampshire State AGbd_12e7e84aa9f8081c2020-12-22 · +38dVerified
Massachusetts State AGbd_857b22b660e99d4a2020-12-21 · +39dVerified
Maine State AGbd_aa415a9b27a3639c2020-12-21 · +39dCandidate

Name: Peabody & Arnold LLP
norm: peabody arnold

Name: Peabody & Arnold LLP
norm: peabody arnold
Industry: Professional Servicesllm

Discovered: —
Breach occurred: May 21, 2020 – May 27, 2020
Materiality determined: —
Notification sent: Jan 28, 2021
Affected individuals: 128state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Submitted supplemental incident notification to the Attorney General of New Hampshire
Initial access: valid_credentials

During the incident: Engaged a cybersecurity firm to assist with the investigation
Notified affected individuals via First-Class U.S. mail
Notified the Attorney General of New Hampshire
Offered complimentary one-year credit monitoring and identity protection services through Experian
Established a dedicated phone number for individuals with questions
Changes made: Enhanced existing security protocols
Re-educated staff for awareness on these types of incidents
Enabled two-factor authentication on an enterprise-wide level
Reset passwords for all users in its email environment
Configured its email tenant to disable legacy email protocols
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 21 · first

Maine State AGDec 21 · first

New Hampshire State AG+1d

Maine State AG+38d

New Hampshire State AG+39d · this page

Pattern: first filing Dec 21 (MA), last Jan 29 (NH) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/peabody-arnold-20210129.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2021
Raw hash: 36a80a0f5c0b12c0a9b7b80e33c9b310f32379bf4e8fbef1d95f4c97f2986c3b

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPeabody & Arnold LLP

Victim entityPeabody & Arnold LLP

IncidentUnauthorized Access

Stated responseEngaged a cybersecurity firm to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov