MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountPIIMediumContained

Fitzgerald, DePietro & Wojnas CPAs, P.C.

bd_98138fd2f9351682 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2024

Filed

Oct 9, 2024

To disclose

16 weeks

Affected

10state residents only

Linked

6 filings

Confidence

66%

Full breach record for Fitzgerald, DePietro & Wojnas CPAs, P.C. →

Fitzgerald, DePietro & Wojnas CPAs, P.C. disclosed a ransomware incident discovered on June 19, 2024. A threat actor encrypted files and exfiltrated tax documents containing PII, SSNs, and financial data. The firm engaged forensic counsel, restored backups, and offered IDX identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 112 days

Jun 19, 2024

Discovered

Oct 9, 2024

Filed

vs. sector median

3 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Leak Sitemedusabd_5f353c840e46a2f02024-06-19 · +112dVerified by operator
Leak Sitemedusabd_179daa6a503f51a42024-06-17 · +113dVerified by operator

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_71788bca92fc61782024-10-09Verified
Massachusetts State AGbd_c175690325b7fafb2024-10-05 · +4dVerified by operator
Pressmedusabd_8741d25aa95b9e272024-06-19 · +112dCandidate

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net
Industry: Professional Servicesllm

Discovered: Jun 19, 2024
Materiality determined: —
Notification sent: Sep 26, 2024
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Severed the threat actor’s access to our networks
Reset IT passwords
Hardened our network
Restored our files from backups
Deployed software to ensure that the threat actor was out of our system
Engaged cybersecurity counsel and a forensics firm
Offering identity theft protection services through IDX
Changes made: Deployed software to ensure that the threat actor was out of our system
Hardened our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

PressJun 19 · first

Massachusetts State AG+108d

Vermont State AG+112d

Montana State AG+112d · this page

Pattern: first filing Jun 19, last Oct 9 (MT) — a 112-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1753.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2024
Raw hash: de7446dc855c83928535d8f3df3050a45d77a33b3e38cf684b564ce4ed6ca8e5

Linked disclosures

Ransomware claims (2)

Regulatory filings (3) · sorted by filing gap

Reporting entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Victim entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Incidentdiscovered Jun 19, 2024

Stated responseSevered the threat actor’s access to our networks

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov