HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Mohr CPAs LLP

bd_7bcbe0140149a87f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2023

Filed

Nov 22, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for Mohr CPAs LLP →

Mohr CPAs LLP notified consumers that an unauthorized party accessed a server on September 29, 2023, and exfiltrated files. The incident was discovered on the same date via suspicious email activity and fraudulent tax e-filing rejections. Affected data includes names, Social Security numbers, dates of birth, and driver's license numbers. The firm engaged forensic specialists, secured its environment, and is offering credit monitoring and fraud assistance to affected clients.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 54 days

Sep 29, 2023

Begins

Sep 29, 2023

Discovered

Nov 22, 2023

Filed

vs. sector median

11 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1604bcc9a26587e32023-11-22Verified
Montana State AGbd_ab1197eef0c79b572023-11-22Candidate
New Hampshire State AGbd_ae703b097bffb8352023-11-22Verified
Maine State AGbd_cc5351b2ecbf5fa12023-11-22Verified

Name: Mohr CPAs LLP
norm: mohr cpas

Name: Mohr CPAs LLP
norm: mohr cpas
Industry: Professional Servicesllm

Discovered: Sep 29, 2023
Breach occurred: Sep 29, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Communicated with the Internal Revenue ServiceCommunicated with Wisconsin Department of RevenueCommunicated with the Federation of Tax Associates
Initial access: valid_credentials

During the incident: Launched an internal investigation
Worked with third-party forensic specialists to perform a thorough investigation
Secured our environment
Communicated with the Internal Revenue Service, Wisconsin Department of Revenue, and the Federation of Tax Associates
Cooperated with agencies' investigations
Changes made: Reviewing and enhancing existing policies and procedures to help prevent a similar future incident
Offering access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGNov 22 · first

Montana State AGNov 22 · first

New Hampshire State AGNov 22 · first

Maine State AGNov 22 · first

Vermont State AGNov 22 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-11-22-mohr-cpas-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 22, 2023
Raw hash: d5fd63b27fc4e8024a1be9dd47979004928025a7f906a4bc2f12ed6fe4333dd8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityMohr CPAs LLP

Victim entityMohr CPAs LLP

Incidentdiscovered Sep 29, 2023

Stated responseLaunched an internal investigation

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov