HackingProfessional ServicesProfessional ServicesVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDMediumContained

M. Arthur Gensler Jr. & Associates, Inc.

bd_904ab57c2f95240f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 8, 2023

Filed

Jul 7, 2023

To disclose

29 days

Affected

Not disclosed

Linked

6 filings

Confidence

66%

Full breach record for M. Arthur Gensler Jr. & Associates, Inc. →

M. Arthur Gensler, Jr. & Associates disclosed a data breach involving the third-party file transfer vendor Progress MOVEit. Between May 27-31, 2023, an unauthorized party accessed and copied files containing names, SSNs, dates of birth, and home addresses of US colleagues. Gensler patched the exploit, secured systems, and offered two years of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock⏱ VT AG >14 bday29 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 12 days

discovery → filing · 29 days

May 27, 2023

Begins

Jun 8, 2023

Discovered

Jul 7, 2023

Filed

vs. sector median

15 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_e71a88311b2e22202023-07-25 · +18dVerified
California State AGbd_2d48359ec90220722023-08-09 · +33dCandidate
Massachusetts State AGbd_52db0b6ecd09f1572023-08-09 · +33dVerified
Indiana State AGbd_b9b8df7423eb405e2023-08-09 · +33dVerified

Show 1 more filing ↓up to 41d gap

Maine State AGbd_f7fd0d0d98414d292023-08-17 · +41dVerified by operator

Name: M. Arthur Gensler Jr. & Associates, Inc.
norm: m arthur gensler jr associates

Name: M. Arthur Gensler Jr. & Associates, Inc.
norm: m arthur gensler jr associates
Industry: Professional Servicesllm

Discovered: Jun 8, 2023
Breach occurred: May 27, 2023 – May 31, 2023
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 7, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Disabled web access to the FTP environment
Patched the exploit
Secured Gensler systems
Began an investigation and forensic analysis
Arranged for complimentary, two-year membership of identity theft protection and credit monitoring services through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: VT AG >14 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Vermont State AGJul 7 · first · this page

New Hampshire State AG+18d

California State AG+33d

Massachusetts State AG+33d

Indiana State AG+33d

Maine State AG+41d

Pattern: first filing Jul 7 (VT), last Aug 17 (ME) — a 41-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-07-07-m-arthur-gensler-jr-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2023
Raw hash: 7e0cdc0d314b8bf1d72f9c7e577df0d8eb428ba3b3348137d39e6cb0f63f7fd9

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityM. Arthur Gensler Jr. & Associates, Inc.

Victim entityM. Arthur Gensler Jr. & Associates, Inc.

Incidentdiscovered Jun 8, 2023

Stated responseDisabled web access to the FTP environment

ComplianceVT AG >14 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov