HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Peter Freuler & Associates CPA

bd_834bc70ebd03c0b7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 3, 2018

Filed

Nov 9, 2018

To disclose

10 weeks

Affected

2state residents only

Linked

2 filings

Confidence

66%

Full breach record for Peter Freuler & Associates CPA →

Peter Freuler & Associates CPA (PFA) notified the NH AG of a data breach where an unauthorized individual accessed files on PFA's network on May 26, 2018. PFA discovered the incident on Sept 3, 2018, following reports of fraudulent tax filings. Two NH residents were affected, with data including names, SSNs, and bank accounts exposed. PFA engaged forensic investigators, enhanced security controls, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 100 days

discovery → filing · 10 weeks / 67 days

May 26, 2018

Begins

Sep 3, 2018

Discovered

Nov 9, 2018

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_ab4b8de033b6021d2018-11-09Verified

Name: Peter Freuler & Associates CPA
norm: peter freuler associates cpa

Name: Peter Freuler & Associates CPA
norm: peter freuler associates cpa
Industry: Professional Servicesllm

Discovered: Sep 3, 2018
Breach occurred: May 26, 2018
Undetected for: 100 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2018
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Hired an independent computer forensics firm to assist
Changed passwords to all employee e-mail accounts
Implemented additional e-mail security enhancements
Added additional layers of security to PFA's remote access process
Reviewed and enhanced security permission responsibilities and rights
Implemented two-factor authentication on various programs
Provided additional training to employees on recognizing and appropriately responding to suspicious emails and other security threats
Offered credit monitoring and identity restoration services free of charge for one year
Changes made: Implemented additional e-mail security enhancements
Added additional layers of security to remote access process
Reviewed and enhanced security permission responsibilities and rights
Implemented two-factor authentication on various programs
Provided additional training to employees on recognizing and appropriately responding to suspicious emails and other security threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(67 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGNov 9 · first

New Hampshire State AGNov 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/peter-freuler-20181109.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2018
Raw hash: 53e45d5704dea2468c858367c469a6cf3c058b16e55fdd7a093a399085db14bc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPeter Freuler & Associates CPA

Victim entityPeter Freuler & Associates CPA

Incidentdiscovered Sep 3, 2018

Stated responseHired an independent computer forensics firm to assist

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov