Social EngineeringFinancial ServicesFinancePhishingTargetedCustomer Data InvolvedIdentity (basic)PIILowContained

Evermay Wealth Management LLC

bd_7cc5f4c71a235a91 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 8, 2024

Filed

Dec 16, 2024

To disclose

5 weeks

Affected · nationwide

5153 in this filing

Confidence

65%

Full breach record for Evermay Wealth Management LLC →

Evermay Wealth Management LLC reported a phishing incident where scammers impersonated the firm to target clients. The firm's IT vendor confirmed no data was extracted from internal networks. Affected individuals received notifications regarding potential exposure of names, phone numbers, or email addresses. 515 individuals were affected in total, including 3 Maine residents.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 8, 2024 → Filed with AG Dec 16, 202438d ⏱ ME AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 18 days

discovery → filing · 5 weeks / 38 days

Oct 21, 2024

Begins

Nov 8, 2024

Discovered

Dec 16, 2024

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed515 affectedView incident

Name: Evermay Wealth Management LLC
norm: evermay wealth management
Domain: evermaywealth.com
Industry: Financial Services

Name: Evermay Wealth Management LLC
norm: evermay wealth management
Domain: evermaywealth.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Nov 8, 2024
Breach occurred: Oct 21, 2024
Undetected for: 18 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 22, 2024
Affected individuals: 515state + nationwide
Data types: Identity (basic)PII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: phishing_link

During the incident: Conducted extensive review of network folders via IT vendor
Changes made: Enhanced monitoring efforts to identify and investigate phishing scams
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(38 days from discovery to filing)
Compliance flags: ME AG >30d · 38d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 8, 2024
→ Filed with AG: Dec 16, 2024
38d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 8, 2024 → Filed with AG: Dec 16, 2024	38d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/18437d5d-55ba-4114-b8b6-a3f88e1e5c18.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2024
Raw hash: 19e5cc73ea484a60b0682933cbc0075699708d82b76c63c376a90bc5d6e4cd32

Reporting entityEvermay Wealth Management LLC

Victim entityEvermay Wealth Management LLC

Incidentdiscovered Nov 8, 2024

Stated responseConducted extensive review of network folders via IT vendor

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov