Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedIdentity (basic)LowContained

John P. Gallina Law Offices

bd_7a0f76c70fada035 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 25, 2023

Filed

Sep 25, 2023

To disclose

22 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

John P. Gallina Law Offices reported a phishing incident on April 25, 2023, involving unauthorized access to a single email account. One New Hampshire resident was notified on September 19, 2023. Impacted data included names and addresses. The firm reset passwords, implemented email restrictions, conducted malware scans, and provided 12 months of credit monitoring via TransUnion/Cyberscout.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 weeks / 153 days

Apr 25, 2023

Discovered

Sep 25, 2023

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_e236d7bf71e47ea62023-09-26 · +1dVerified

Name: John P. Gallina Law Offices
norm: john p gallina law offices
Domain: jgallinalaw.com

Name: John P. Gallina Law Offices
norm: john p gallina law offices
Domain: jgallinalaw.com
Industry: Professional Servicesllm

Discovered: Apr 25, 2023
Materiality determined: —
Notification sent: Sep 19, 2023
Affected individuals: 1state-resident count only
Data types: Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: The password for the email account was reset
John P. Gallina Law Offices implemented additional restrictions on providing or receiving personal information by email
Conducted additional malware and virus scans of the email account
Engaged a vendor to review documents in the account to identify and extract any personal identifiable information
Arranged for affected individuals to receive credit monitoring and identity protection services provided by TransUnion
Changes made: Implemented additional restrictions on providing or receiving personal information by email
Improving our security posture by conducting additional malware and virus scans of the email account
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 weeks(153 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGSep 25 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/john-p-gallina-law-offices-20230925.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 25, 2023
Raw hash: 5100c35911c27b196b9e576681e31ff1da9110aceeaddda0d4c72caeb409fc69

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJohn P. Gallina Law Offices

Victim entityJohn P. Gallina Law Offices

Incidentdiscovered Apr 25, 2023

Stated responseThe password for the email account was reset

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov