HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Black, Bashor & Porsch, LLP

bd_7bea3f46a86f4267 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 11, 2024

Filed

Nov 13, 2025

To disclose

—

Affected

5state residents only

Confidence

67%

Full breach record for Black, Bashor & Porsch, LLP →2 incidents on file

Black, Bashor & Porsch, LLP (BBP) notified the Maryland Attorney General on January 24, 2025, of a data security incident discovered on December 11, 2024. An unauthorized actor acquired files containing names and Social Security numbers of 5 Maryland residents. BBP engaged independent cybersecurity experts, secured the network, and offered 12 months of credit monitoring and ID theft recovery services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

Incident timeline

Dec 11, 2024

Discovered

Nov 13, 2025

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5 affectedView incident

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Black, Bashor & Porsch, LLP
norm: black bashor porsch
Domain: bbpcpa.com
Industry: Professional Servicesllm

Discovered: Dec 11, 2024
Materiality determined: —
Notification sent: Jan 24, 2025
Affected individuals: 5state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Maryland Attorney General
Initial access: valid_credentials

During the incident: Took steps to secure the network
Launched an investigation, aided by independent cybersecurity experts
Implemented additional security measures
Offered notified individuals 12 months of complimentary services through Identity Defense Complete
Changes made: Implemented additional security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376237.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 13, 2025
Raw hash: 3f0be0f893dd2afc82fd4afdebaae77a68b794c4e3c36ab8a00389ae4fbe214c

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityBlack, Bashor & Porsch, LLP

Incidentdiscovered Dec 11, 2024

Stated responseTook steps to secure the network

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov