HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedIdentity (basic)LowContained

Brown & Streza, LLP

bd_807d8fea0e6122fd · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 5, 2023

Filed

Dec 22, 2023

To disclose

15 weeks

Affected

2state residents only

Linked

9 filings

Confidence

66%

Full breach record for Brown & Streza, LLP →

Brown & Streza, LLP issued a supplemental notice regarding a September 2023 network intrusion. An unknown actor gained unauthorized access, potentially exposing names and other personal information. The firm engaged forensic investigators, notified law enforcement, and offered Experian identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 108 days

Sep 5, 2023

Discovered

Dec 22, 2023

Filed

vs. sector median

2 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelosttrustbd_f929cda0efe9b7eb2023-09-26 · +87dVerified by operator

Regulatory filings (7) · sorted by filing gap

Massachusetts State AGbd_006b1d203b6c9d072023-12-22Verified
California State AGbd_4007dc1bfdd337302023-12-22Verified
Vermont State AGbd_0663a08426d271252023-05-12 · +224dVerified by operator
Massachusetts State AGbd_57809da712dfd9f22023-05-12 · +224dVerified by operator

Show 3 more filings ↓up to 224d gap

Indiana State AGbd_80bcc587bca48cf82023-05-12 · +224dVerified by operator
Montana State AGbd_9cf9bf5bf5fe645c2023-05-12 · +224dVerified by operator
California State AGbd_a3fdea8d506e32402023-05-12 · +224dVerified by operator

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com
Industry: Professional Servicesllm

Discovered: Sep 5, 2023
Materiality determined: —
Notification sent: Dec 22, 2023
Affected individuals: 2state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported this incident to law enforcement
Initial access: valid_credentials

During the incident: Enlisted a leading cybersecurity firm to conduct a forensic investigation
Reported this incident to law enforcement
Implemented additional security measures
Offering you complimentary identity protection services through Experian IdentityWorks
Changes made: Implemented additional security measures to help reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(108 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Vermont State AGMay 12 · first

Massachusetts State AGMay 12 · first

Indiana State AGMay 12 · first

Montana State AGMay 12 · first

California State AGMay 12 · first

Massachusetts State AG+224d

California State AG+224d

Montana State AG+224d · this page

Pattern: first filing May 12 (VT), last Dec 22 (MT) — a 224-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-977.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 22, 2023
Raw hash: 262ec7f37640cdf1030b16b993020c5c8e0281e819f3a585e0f59b37359049cd

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityBrown & Streza, LLP

Victim entityBrown & Streza, LLP

Incidentdiscovered Sep 5, 2023

Stated responseEnlisted a leading cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov