HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDFinancial accountEmploymentMediumResolved

Friedman & Perry, CPA's

bd_89995c525614d536 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2017

Filed

Mar 9, 2017

To disclose

4 weeks

Affected

2state residents only

Linked

3 filings

Confidence

64%

Full breach record for Friedman & Perry, CPA's →

Friedman & Perry, CPA's disclosed a data breach where hackers gained unauthorized access via Remote Desktop Protocol between June 15, 2016 and January 30, 2017. The firm discovered the incident on February 6, 2017, after clients received IRS/FTB notifications of attempted fraudulent tax filings. Exposed data included names, SSNs, DOBs, and financial account information. The firm engaged forensic investigators, notified law enforcement (FBI, IRS), rebuilt its IT infrastructure, and offered 12 months of identity protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 236 days

discovery → filing · 4 weeks / 31 days

Jun 15, 2016

Begins

Feb 6, 2017

Discovered

Mar 9, 2017

Filed

vs. sector median

14 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

California State AGbd_05beb523b71b294f2017-03-08 · +1dCandidate
Massachusetts State AGbd_5d8cbb870fd130a02017-03-08 · +1dVerified

Name: Friedman & Perry, CPA's
norm: friedman perry cpa s

Name: Friedman & Perry, CPA's
norm: friedman perry cpa s
Industry: Professional Servicesllm

Discovered: Feb 6, 2017
Breach occurred: Jun 15, 2016 – Jan 30, 2017
Undetected for: 236 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 9, 2017
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: notified the FBInotified the IRSnotified the FTBnotified applicable state agencies
Initial access: external_remote_services

During the incident: Contacted our IT consultant
Ensured that all system passwords were changed and user information was secure
Started running scans and reviewing our systems to identify any malicious malware on our computers
Hired a specialized forensic IT firm for additional investigation
Notified the FBI, the IRS, the FTB, all three credit bureaus, applicable state agencies
Hired IT security experts and rebuilt our system with a new router, hard drives and a new server
Working with law enforcement in their investigation of the criminals
Changes made: Reviewing office policies and procedures to ensure all security measures are taken to avoid such an incident from occurring again
Rebuilt our system with a new router, hard drives and a new server to eliminate any possibility of malicious remnants being possibly installed on our system
Arranged to have AllClear ID protect your identity for 12 months at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

California State AGMar 8 · first

Massachusetts State AGMar 8 · first

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Friedman-Perry-CPAs.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 9, 2017
Raw hash: 470c8d8d3e58849abc44830a8a00339e398dde9819f39b01c260868e2dd73c7f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityFriedman & Perry, CPA's

Victim entityFriedman & Perry, CPA's

Incidentdiscovered Feb 6, 2017

Stated responseContacted our IT consultant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov