HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedGovernment IDIdentity (basic)Financial accountEmploymentMediumContained

Veyna & Forschino

bd_7967bd8bcb780a45 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 27, 2017

Filed

Dec 21, 2017

To disclose

24 days

Affected

Not disclosed

Linked

2 filings

Confidence

64%

Full breach record for Veyna & Forschino →

Veyna & Forschino experienced unauthorized access to a company workstation via remote desktop application between Nov 6-24, 2017. Suspicious activity was detected on Nov 27, 2017. Affected data included names, SSNs, tax returns, and bank account information. The firm engaged forensic investigators, notified law enforcement and regulators, and offered credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 27, 2017 → Notified Dec 22, 201725d ✓ CA 60-day OK24 days discovery → filing

Incident timeline

undetected · 21 days

discovery → filing · 24 days

Nov 6, 2017

Begins

Nov 27, 2017

Discovered

Dec 21, 2017

Filed

vs. sector median

16 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_bab2d15701f8b6ee2017-12-21Verified

Name: Veyna & Forschino
norm: veyna forschino

Name: Veyna & Forschino
norm: veyna forschino
Industry: Professional Servicesllm

Discovered: Nov 27, 2017
Breach occurred: Nov 6, 2017 – Nov 24, 2017
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2017
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountEmployment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1114 Email CollectionT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBINotified the IRSNotified the FTBNotified all applicable state agencies
Initial access: external_remote_services

During the incident: Disabled access to the compromised email account
Hired a specialized forensic IT firm to assist in the investigation
Notified the FBI
Notified the IRS
Notified the FTB
Notified all three credit bureaus
Notified all applicable state agencies
Offering identity theft protection services through ID Experts
Changes made: Reviewing office policies and procedures to ensure all security measures are taken to avoid such an incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: CA 60-day OK · 25d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 27, 2017
→ Notified: Dec 22, 2017
25d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 27, 2017 → Notified: Dec 22, 2017	25d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGDec 21 · first

California State AGDec 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-131389
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 21, 2017
Raw hash: ca64991650bff30e3ace7f815c1a826c85fe02f36a8ca4e2de24a9728424d7f6

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityVeyna & Forschino

Victim entityVeyna & Forschino

Incidentdiscovered Nov 27, 2017

Stated responseDisabled access to the compromised email account

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov