HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedGovernment IDIdentity (basic)MediumContained

OC Fleming Taxes

bd_7aecf57bdbd15a63 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 17, 2024

Filed

Jan 29, 2025

To disclose

6 weeks

Affected · nationwide

533 in this filing

Confidence

66%

Full breach record for OC Fleming Taxes →

OC Fleming Taxes reported a data event involving unauthorized access to its email environment, discovered on December 17, 2024. The incident compromised Social Security numbers and driver's license numbers for 53 individuals total, including 3 Maryland residents. Notification letters were mailed on January 29, 2025. The company offered 24 months of credit monitoring and identity theft restoration services.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d6 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 85 days

discovery → filing · 6 weeks / 43 days

Sep 23, 2024

Begins

Dec 17, 2024

Discovered

Jan 29, 2025

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed53 affectedView incident

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: OC Fleming Taxes
norm: oc fleming taxes
Industry: Financial Servicesllm

Discovered: Dec 17, 2024
Breach occurred: Sep 23, 2024
Undetected for: 85 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 29, 2025
Affected individuals: 53state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Attorney General
Initial access: valid_credentials

During the incident: Began an investigation into the scope and nature of the suspicious activity
Retained legal counsel
Conducted a comprehensive review of the data set
Offered 24 months of complimentary credit monitoring and identity theft restoration services through TransUnion
Provided guidance on how to better protect against identity theft and fraud
Changes made: Offered 24 months of complimentary credit monitoring and identity theft restoration services through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(43 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376264.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2025
Raw hash: 7a462ef7a1357945f697acc4bd5591c03734e3ccecec4ecd05899fa8b65ebe2e

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityOC Fleming Taxes

Incidentdiscovered Dec 17, 2024

Stated responseBegan an investigation into the scope and nature of the suspicious activity

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov