HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Smith & Company

bd_79e8293973f49c37 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 23, 2021

Filed

May 6, 2021

To disclose

6 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Smith & Company →

Smith & Company, a CPA firm, notified clients that cybercriminals compromised their Electronic Filing ID via third-party provider Intuit on March 23, 2021. Affected data included names, addresses, dates of birth, SSNs, and bank account numbers. The firm notified the IRS, ceased transmissions, and engaged security experts. Remediation includes server upgrades and firewall reinforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 44 days

Mar 23, 2021

Discovered

May 6, 2021

Filed

vs. sector median

13 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Smith & Company
norm: smith company
Domain: smith-wesson.com

Name: Smith & Company
norm: smith
Domain: smithcpas.com
Industry: Professional Servicesllm

Discovered: Mar 23, 2021
Materiality determined: —
Notification sent: Apr 22, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the IRS
Third party: via Intuit
Initial access: supply_chain

During the incident: Notified the IRS directly of the fraudulent activity
Ceased the transmission of all returns potentially impacted
Worked with Intuit’s Fraud Department to reapply for a new, secure Electronic Filing ID number
Working with expert Information Technology organization
Engaged a leading Cyber Security Firm
Working with Intuit’s Fraud Department
Working with the IRS
Changes made: Upgrading our servers
Reinforcing our firewalls
Administering vulnerability scans
Strengthening internal security protocols
Offering 12 months of complimentary credit monitoring and identity theft prevention services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/smith-certified-public-accountants-20210506.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 6, 2021
Raw hash: 9e8a8a237654ec07c730699b96566c20699ff659aa770e32c3b8049c6373b0e7

Reporting entitySmith & Company

Victim entitySmith & Company

Incidentdiscovered Mar 23, 2021

Stated responseNotified the IRS directly of the fraudulent activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov