Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsRansom DemandedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumContained

Olinsky & Associates, PLLC

bd_972f5dbdce5657a9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2025

Filed

Mar 11, 2025

To disclose

6 weeks

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for Olinsky & Associates, PLLC →

Olinsky & Associates, PLLC notified the Maryland Attorney General of a phishing attack discovered on January 28, 2025. Criminal actors used stolen credentials to access a shared drive, compromising personal, health, and financial data of two Maryland residents. Olinsky engaged forensic investigators, notified the FBI and police, and provided two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d6 weeks discovery → filing

Incident timeline

discovery → filing · 6 weeks / 42 days

Jan 28, 2025

Discovered

Mar 11, 2025

Filed

vs. sector median

13 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_afb7511ee47500062025-03-11Verified
Montana State AGbd_cdcde3b568db9fd72025-03-11Candidate
Indiana State AGbd_f4c5a4ecf57312492025-03-11Verified
Massachusetts State AGbd_4147b645a8b87dfe2025-03-12 · +1dVerified

Name: Olinsky & Associates, PLLC
norm: olinsky associates

Name: Olinsky & Associates, PLLC
norm: olinsky associates
Industry: Professional Servicesllm

Discovered: Jan 28, 2025
Materiality determined: —
Notification sent: Mar 11, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Reported this incident to the policeReported this incident to the FBI
Initial access: phishing_link

During the incident: Took steps to secure its systems
Began an investigation with the assistance of a forensic firm
Secured its systems immediately after learning of the attack
Reported this incident to the police
Reported this incident to the FBI
Provided initial notice to all conceivably impacted individuals
Provided additional notice to those individuals for whom we had e-mail addresses
Mailed notification letters via United States Postal Service First-Class mail to the Maryland residents
Secured credit-monitoring services for you
Changes made: Implemented multi-factor authentication for VPN connections
Implemented web filtering
Installed additional cybersecurity software such as SSL deep inspection and SentinelOne
Retrained its employees on security measures and protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

New Hampshire State AGMar 11 · first

Montana State AGMar 11 · first

Indiana State AGMar 11 · first

Maryland State AGMar 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376530.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2025
Raw hash: fc2aa2b66523f471488c917c1507ab25b8e38f8b53d395d80b00f895907ae861

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOlinsky & Associates, PLLC

Victim entityOlinsky & Associates, PLLC

Incidentdiscovered Jan 28, 2025

Stated responseTook steps to secure its systems

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov