HackingProfessional ServicesProfessional ServicesPhishingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Hartson-Kennedy

bd_906a300ba3031aaa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 9, 2024

Filed

Feb 19, 2025

To disclose

19 weeks

Affected

1state residents only

Linked

5 records

Confidence

66%

Full breach record for Hartson-Kennedy →

Hartson-Kennedy Inc. notified the Maryland AG of a security incident discovered on October 9, 2024. An attacker accessed systems starting June 24, 2024, via a malicious ad (phishing), gaining access to employee and dependent data including PII, SSNs, and financial/health info. One Maryland resident was identified. The incident is contained; 24 months of credit monitoring is offered.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d19 weeks discovery → filing

Incident timeline

undetected · 107 days

discovery → filing · 19 weeks / 133 days

Jun 24, 2024

Begins

Oct 9, 2024

Discovered

Feb 19, 2025

Filed

vs. sector median

1 wks faster

This filing is one of 5 records about the same incident.View merged incident

A leak claim by cl0p about this victim was first seen 137 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_29775cf086fd0ba92024-10-05 · +137dVerified by operator

Regulatory filings (3) · sorted by filing gap

Nebraska State AGbd_e34e49bb94e3757a2025-02-20 · +1dVerified
Maine State AGbd_08b68c9085fac50c2025-02-21 · +2dVerified
Massachusetts State AGbd_88ca3823a1cffca02025-02-21 · +2dVerified

Name: Keating Muething & Klekamp PLL
norm: keating muething klekamp pll

Name: Hartson-Kennedy
norm: hartson kennedy
Domain: hartson-kennedy.com
Industry: Professional Servicesllm

Discovered: Oct 9, 2024
Breach occurred: Jun 24, 2024
Undetected for: 107 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 9, 2024
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Maryland Attorney General
Initial access: phishing_link

During the incident: Worked to successfully contain the intrusion
Began its investigation with the help of legal and computer forensics teams
Engaged in comprehensive data mining work
Mailed notifications to the individuals it initially identified as potentially impacted
Providing 24 months of free single-bureau credit monitoring and fraud assistance services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(133 days from discovery to filing)
Compliance flags: MD AG >90dLeak >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maryland State AGFeb 19 · first · this page

Nebraska State AG+1d

Maine State AG+2d

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376377.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2025
Raw hash: d123387b4fdc5584aa43d2df041bb58a2d8824add1f45567a70544c96d0a9ff3

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityKeating Muething & Klekamp PLL

Victim entityHartson-Kennedy

Incidentdiscovered Oct 9, 2024

Stated responseWorked to successfully contain the intrusion

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov