HackingProfessional ServicesProfessional ServicesStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedRansom DemandedIdentity (basic)Government IDHighContained

SD Associates, P.C.

bd_846c823b3617b1db · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 27, 2016

Filed

Jun 2, 2016

To disclose

5 weeks

Affected · nationwide

7,0004 in this filing

Linked

2 filings

Confidence

65%

Full breach record for SD Associates, P.C. →

SD Associates P.C., a CPA firm, disclosed a cyber intrusion occurring April 21-27, 2016. Criminals stole names, addresses, and SSNs of approximately 7,000 clients to file false tax returns. SD learned of the breach on April 27, 2016, upon IRS contact. Notifications were sent June 7, 2016, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 5 weeks / 36 days

Apr 21, 2016

Begins

Apr 27, 2016

Discovered

Jun 2, 2016

Filed

vs. sector median

12 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_1b2e0a9592579ced2016-06-06 · +4dVerified

Name: ECKERT SEAMANS CHERIN & MELLOTT, LLC
norm: eckert seamans cherin mellott

Name: SD Associates, P.C.
norm: sd associates
Domain: sdaccounting.com
Industry: Professional Servicesllm

Discovered: Apr 27, 2016
Breach occurred: Apr 21, 2016 – Apr 27, 2016
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 7, 2016
Affected individuals: 7,000state + nationwide
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the New Hampshire Attorney GeneralLearned from the State of Pennsylvania Bureau of Professional Affairs that cyber criminals have engaged in similar attacks against accounting firms across the State
Initial access: valid_credentials

During the incident: Retained a forensic computer consultant to perform an analysis of the incident
Upgraded SD's system security
Provided formal written notification to all affected individuals
Provided the option for each affected person to enroll in a credit and identity theft protection program for one (1) year, furnished through a nationally recognized identity theft vendor
Notified the three major U.S. credit reporting agencies of this incident
Changes made: Upgraded security to prevent any further unlawful entry
Recommended applying for the IRS Identity Protection Pin
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJun 2 · first · this page

Massachusetts State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sd-associates-20160602.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 2, 2016
Raw hash: 5020cdaa67e91f5f789d2d74af3204c81a4c67c8af5cf026276610e99dad2598

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityECKERT SEAMANS CHERIN & MELLOTT, LLC

Victim entitySD Associates, P.C.

Incidentdiscovered Apr 27, 2016

Stated responseRetained a forensic computer consultant to perform an analysis of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov