HackingFinancial ServicesFinanceCustomer Data InvolvedIdentity (basic)Government IDHigh

Butler, Lavanceau & Sober

bd_960ef2d7152c69e2 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 21, 2024

Filed

Apr 19, 2024

To disclose

29 days

Affected · nationwide

3,3707 in this filing

Linked

4 records

Confidence

63%

Full breach record for Butler, Lavanceau & Sober →

Butler, Lavanceau, & Sober, LLC, a financial services company, reported an external system breach that occurred on February 20, 2024, and was discovered on March 21, 2024. The incident affected 3,370 individuals, exposing their names and driver's license or non-driver ID numbers. The company began notifying affected individuals on April 17, 2024, and offered 12 months of identity protection services through Identity Defense.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d29 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 30 days

discovery → filing · 29 days

Feb 20, 2024

Begins

Mar 21, 2024

Discovered

Apr 19, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 4 records about the same incident.View merged incident

A leak claim by snatch about this victim was first seen 32 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesnatchbd_9a683b976a779fbf2024-03-17 · +32dVerified by operator

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_4a1f0002ee6a10dc2024-04-20 · +1dVerified
Indiana State AGbd_411e21453d2a16152024-04-17 · +2dCandidate

Name: Constangy, Brooks, Smith & Prophete, LLP
norm: constangy brooks smith prophete

Name: Butler, Lavanceau & Sober
norm: butler lavanceau sober
Domain: blscpafirm.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Mar 21, 2024
Breach occurred: Feb 20, 2024
Undetected for: 30 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 17, 2024
Affected individuals: 3,370state + nationwide
Data types: Identity (basic)Government ID
Data elements: Driver's licence number
Attack vector: Unauthorized Access
Threat actor: External

Changes made: 12 Months; Identity Defense; Credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: Leak >30dME AG ≤30d · 29d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 21, 2024
→ Filed with AG: Apr 19, 2024
29d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 21, 2024 → Filed with AG: Apr 19, 2024	29d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGApr 17 · first

Maine State AG+2d · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/e2796c75-9d54-4a05-99d9-dbbfcdd0bc74.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 19, 2024
Raw hash: dcaf4d7c43268244a3d247495476df906919a9638f56478247083b4486e114e6

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityConstangy, Brooks, Smith & Prophete, LLP

Victim entityButler, Lavanceau & Sober

Incidentdiscovered Mar 21, 2024

Stated response12 Months; Identity Defense; Credit monitoring and identity protection services

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov