Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedPIIIdentity (basic)FinancialLowContained

Martin, Hutchison and Hohman, CPAs

bd_92e20a2727091503 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 15, 2019

Filed

Feb 21, 2019

To disclose

6 days

Affected

Not disclosed

Confidence

64%

Martin, Hutchison and Hohman, CPAs experienced a data breach on February 15, 2019, after a partner fell victim to a tech support scam. The attacker gained remote access to a computer containing unencrypted tax documents and client data. The firm contained the incident by disconnecting the device and replacing the hard drive. Client PII, including tax returns, was potentially compromised.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 15, 2019 → Notified Feb 19, 20194d ✓ CA 60-day OK6 days discovery → filing

Incident timeline

discovery → filing · 6 days

Feb 15, 2019

Begins

Feb 15, 2019

Discovered

Feb 21, 2019

Filed

vs. sector median

18 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Martin, Hutchison and Hohman, CPAs
norm: martin hutchison and hohman
Domain: hhco.cpa

Name: Martin, Hutchison and Hohman, CPAs
norm: martin hutchison and hohman
Domain: hhco.cpa
Industry: Professional Servicesllm

Discovered: Feb 15, 2019
Breach occurred: Feb 15, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2019
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Financial
Attack vector: Unknown
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1059 Command and Scripting Interpreter
Threat actor: External
Initial access: phishing_link

During the incident: Disconnected computer from the internet and office network
Uninstalled remote access software
Contacted local computer technician
Took computer to technician for virus check and cleaning
Replaced hard drive
Performing virus scans of all computers
Upgrading virus software as needed
Changing physical controls to store client data in encrypted form
Sending notification to potentially affected clients
Changes made: Upgrading virus software as needed
Changing physical controls which include storing more, if not all, of our client data in an encrypted form
No longer allowing an outside technician to remotely access any computer on our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: CA 60-day OK · 4d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 15, 2019
→ Notified: Feb 19, 2019
4d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 15, 2019 → Notified: Feb 19, 2019	4d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144891
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2019
Raw hash: d8c6e307141b9979487201a34601b2240988a223dec75e089fb4bd522a0d3db8

Reporting entityMartin, Hutchison and Hohman, CPAs

Victim entityMartin, Hutchison and Hohman, CPAs

Incidentdiscovered Feb 15, 2019

Stated responseDisconnected computer from the internet and office network

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov