HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)LowContained

Arsenault and Cline CPA's Inc

bd_8671d68fa67f1dcd · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 10, 2023

Filed

Mar 5, 2024

To disclose

34 weeks

Affected

15state residents only

Confidence

66%

Full breach record for Arsenault and Cline CPA's Inc →

Arsenault and Cline CPA's Inc notified NH AG of unauthorized access to two employee email accounts starting June 23, 2023. Suspicious activity identified July 10, 2023. Investigation confirmed personal information (names, addresses, etc.) may have been viewed. 15 NH residents affected. Notifications sent March 1, 2024, offering 12 months credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 17 days

discovery → filing · 34 weeks / 239 days

Jun 23, 2023

Begins

Jul 10, 2023

Discovered

Mar 5, 2024

Filed

vs. sector median

+16 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed15 affectedView incident

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Arsenault and Cline CPA's Inc
norm: arsenault and cline cpa s
Industry: Professional Servicesllm

Discovered: Jul 10, 2023
Breach occurred: Jun 23, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2024
Affected individuals: 15state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau
Initial access: valid_credentials

During the incident: Engaged third-party independent cybersecurity experts to conduct a thorough investigation
Technology team acted quickly to mitigate the incident
Provided affected residents with written notification
Offered complimentary memberships with a credit monitoring service
Changes made: Continually evaluates and modifies practices and internal controls to enhance security and privacy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 34 weeks(239 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/arsenault-cline-cpas-20240305.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2024
Raw hash: b59a48f9c6520c40a1c815f83b895d811aa152612f28a95515a9a6a3e7517a66

Reporting entityMCDONALD HOPKINS LLC

Victim entityArsenault and Cline CPA's Inc

Incidentdiscovered Jul 10, 2023

Stated responseEngaged third-party independent cybersecurity experts to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov