HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)Government IDMediumContained

Bronstein & Carmona, P.A.

bd_9401a07bbe4c1194 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2024

Filed

Dec 6, 2024

To disclose

44 weeks

Affected

3state residents only

Linked

5 filings

Confidence

67%

Full breach record for Bronstein & Carmona, P.A. →

Bronstein & Carmona, P.A. reported a network compromise detected on February 2, 2024. The incident impacted personal information of 3 New Hampshire residents, including names, dates of birth, and Social Security numbers. The firm engaged third-party experts, enhanced security, retrained staff, and notified law enforcement. Affected individuals were offered credit monitoring and identity protection services through TransUnion.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d44 weeks discovery → filing

Incident timeline

discovery → filing · 44 weeks / 308 days

Feb 2, 2024

Discovered

Dec 6, 2024

Filed

vs. sector median

+26 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by cl0p about this victim predates this filing by 293 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_d2b85620cff925c62024-02-16 · +293dVerified

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_478373d634e526062024-12-06Verified by operator
Indiana State AGbd_82d370da8bc287682024-12-06Verified
Maine State AGbd_d83575d923c9d9a82024-12-06Candidate

Name: Bronstein & Carmona, P.A.
norm: bronstein carmona
Domain: bronstein-carmona.com

Name: Bronstein & Carmona, P.A.
norm: bronstein carmona
Domain: bronstein-carmona.com
Industry: Professional Servicesllm

Discovered: Feb 2, 2024
Materiality determined: —
Notification sent: Dec 6, 2024
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: valid_credentials

During the incident: Secured and remediated the compromise
Engaged additional third-party experts
Enhanced its data security
Commenced an investigation
Conducted an extensive third-party data mining process
Worked with experts to investigate how the incident occurred
Took appropriate hardening steps to enhance network security and data privacy
Retrained employees on phishing and information governance
Notified law enforcement regarding this incident
Mailed incident notification letters to residents
Changes made: Enhanced network security and data privacy
Retrained employees on phishing and information governance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(308 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGDec 6 · first

Indiana State AGDec 6 · first

Maine State AGDec 6 · first

New Hampshire State AGDec 6 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/bronstein-carmona-20241206.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 6, 2024
Raw hash: 498f34daa3ea7a881415d05bfad2120cd200b207625f1faa6fbdd9c44f43b844

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityBronstein & Carmona, P.A.

Victim entityBronstein & Carmona, P.A.

Incidentdiscovered Feb 2, 2024

Stated responseSecured and remediated the compromise

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov