HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedCustomer Data InvolvedData ExfiltratedGovernment IDIdentity (basic)Financial accountEmploymentFinancialMediumContained

Wheeler & Egger, CPAs

bd_8e1c0502d77c4151 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 15, 2016

Filed

Sep 11, 2016

To disclose

27 days

Affected

Linked

4 filings

Confidence

65%

Full breach record for Wheeler & Egger, CPAs →

Wheeler & Egger, CPAs, LLP discovered on August 15, 2016, that an external actor hacked into their system between August 3 and August 9, 2016. The attacker fraudulently filed 45 client tax returns using stolen personal and financial information, including SSNs and bank account details. The firm engaged IT consultants, removed malware, notified law enforcement (FBI, Secret Service, IRS, FTB), and offered credit monitoring to affected clients.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 15, 2016 → Notified Sep 13, 201629d ✓ CA 60-day OK27 days discovery → filing

Incident timeline

undetected · 12 days

discovery → filing · 27 days

Aug 3, 2016

Begins

Aug 15, 2016

Discovered

Sep 11, 2016

Filed

vs. sector median

15 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_d47a9b3a7130cd502016-09-11Verified
South Carolina State AGbd_7ed17255263123b82016-09-12 · +1dCandidate
Montana State AGbd_1a0b44c384a5de162016-09-13 · +2dVerified

Name: Wheeler & Egger, CPAs
norm: wheeler egger cpas
Domain: www.WEcpas4u.com

Name: Wheeler & Egger, CPAs
norm: wheeler egger cpas
Domain: www.WEcpas4u.com
Industry: Professional Servicesllm

Discovered: Aug 15, 2016
Breach occurred: Aug 3, 2016 – Aug 9, 2016
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 13, 2016
Affected individuals: 45nationwide
Data types: Government IDIdentity (basic)Financial accountEmploymentFinancial
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the IRSNotified the FTBNotified the FBINotified the FDICNotified the US Secret ServiceNotified the offices of the applicable State Attorney Generals

During the incident: Removed malware on the impacted computers' hard drives
Made internal software system management changes
Confirmed all network firewalls, computers and security protections are properly functioning
Engaged local IT consultant and an IT firm from the Bay Area for investigation
Notified the IRS, FTB, FBI, FDIC and the US Secret Service
Placed returns on the IRS and FTB's Fraud Alert
Filed Police Report with the FBI's online Internet Crime Complaint Center (IC3)
Notified all three consumer reporting agencies
Notified the offices of the applicable State Attorney Generals
Offered one year of complimentary credit monitoring through AllClear ID
Changes made: Removed malware on the impacted computers' hard drives
Made internal software system management changes
Confirmed all network firewalls, computers and security protections are properly functioning
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: CA 60-day OK · 29d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 15, 2016
→ Notified: Sep 13, 2016
29d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 15, 2016 → Notified: Sep 13, 2016	29d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGSep 11 · first

California State AGSep 11 · first · this page

South Carolina State AG+1d

Montana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-63840
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2016
Raw hash: d2022670206b8e0a12082093a84c56c3150db70d5790f8d521877aa4726875db

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWheeler & Egger, CPAs

Victim entityWheeler & Egger, CPAs

Incidentdiscovered Aug 15, 2016

Stated responseRemoved malware on the impacted computers' hard drives

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov