HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsHighContained

Gunster, Yoakley, & Stewart, PA

bd_78b60ff13445b0ec · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 27, 2022

Filed

Dec 4, 2023

To disclose

12 months

Affected

8,605state residents only

Linked

5 filings

Confidence

64%

Full breach record for Gunster, Yoakley, & Stewart, PA →7 incidents on file

Gunster, Yoakley & Steward, PA detected unauthorized access to its document management file system on November 27, 2022. The access occurred between July 20, 2022, and November 27, 2022. The incident affected 8,605 California residents, exposing names, Social Security numbers, driver's license numbers, financial account numbers, payment card numbers, passport numbers, medical treatment information, health insurance information, and credentials. Gunster contained the incident, notified law enforcement, and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 27, 2022 → Notified Dec 1, 2023369d ✗ CA 60-day late12 months discovery → filing

Incident timeline

undetected · 130 days

discovery → filing · 12 months / 372 days

Jul 20, 2022

Begins

Nov 27, 2022

Discovered

Dec 4, 2023

Filed

vs. sector median

+34 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Washington State AGbd_c61ec90b1a7d4d8d2023-12-04Verified
Montana State AGbd_87b5af26203b089e2023-08-04 · +122dCandidate
New Hampshire State AGbd_e920547675f271aa2023-08-04 · +122dVerified
South Carolina State AGbd_a3b412bcc9b03adc2024-08-01 · +241dVerified

Name: Gunster, Yoakley, & Stewart, PA
norm: gunster yoakley stewart
Domain: gunster.com

Name: Gunster, Yoakley, & Stewart, PA
norm: gunster yoakley stewart
Domain: gunster.com
Industry: Professional Servicesllm

Discovered: Nov 27, 2022
Breach occurred: Jul 20, 2022 – Nov 27, 2022
Undetected for: 130 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 1, 2023
Affected individuals: 8,605state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Took measures to contain the incident and securely restore its network
Conducted a thorough investigation with the assistance of firms that have helped other law firms address similar incidents
Notified federal law enforcement
Began mailing notifications to individuals in April 2023
Provided substitute notice via nationwide media and a post on Gunster’s website on August 4, 2023
Began mailing additional notification letters via United States Postal Service First-Class mail on December 1, 2023
Offering the residents a complimentary membership to credit monitoring and identity protection services through Kroll
Established a dedicated, toll-free call center to answer questions the individuals may have
Changes made: Implemented additional measures to further strengthen the security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(372 days from discovery to filing)
Compliance flags: CA 60-day late · 369d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 27, 2022
→ Notified: Dec 1, 2023
369d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 27, 2022 → Notified: Dec 1, 2023	369d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGAug 4 · first

New Hampshire State AGAug 4 · first

Washington State AG+122d

California State AG+122d · this page

South Carolina State AG+363d

Pattern: first filing Aug 4 (MT), last Aug 1 (SC) — a 363-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-577421
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2023
Raw hash: b60d5705e4eaf0efd206d1eb1d65c6eb769189cce02098b0b9472e35d823a42d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGunster, Yoakley, & Stewart, PA

Victim entityGunster, Yoakley, & Stewart, PA

Incidentdiscovered Nov 27, 2022

Stated responseTook measures to contain the incident and securely restore its network

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov