HackingPhishingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICMediumContained
Hartson-Kennedy
bd_906a300ba3031aaa · schema v1 · pii pii-v1
Full breach record for Hartson-Kennedy →Hartson-Kennedy Inc. notified the Maryland AG of a security incident discovered on October 9, 2024. An attacker accessed systems starting June 24, 2024, via a malicious ad (phishing), gaining access to employee and dependent data including PII, SSNs, and financial/health info. One Maryland resident was identified. The incident is contained; 24 months of credit monitoring is offered.
Maryland clock✗ MD AG >90d19 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
A leak claim by cl0p about this victim predates this filing by 136 days.View originating leak claim
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376377.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 19, 2025
- Raw hash
- d123387b4fdc5584aa43d2df041bb58a2d8824add1f45567a70544c96d0a9ff3
Reporting entity
- Name
- Keating Muething & Klekamp PLLnorm: keating muething klekamp pll
Victim entity
- Name
- Hartson-Kennedynorm: hartson kennedy
- Domain
- hartson-kennedy.com
Incident
- Discovered
- Oct 9, 2024
- Materiality determined
- —
- Notification sent
- Dec 9, 2024
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Phishing
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified the Office of the Maryland Attorney General
- Initial access
- phishing_link
Compliance
- Time to disclose
- 19 weeks(133 days from discovery to filing)
- Compliance flags
- MD AG >90dLeak >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.