MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountPIIMediumContained

Fitzgerald, DePietro & Wojnas CPAs, P.C.

bd_98138fd2f9351682 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2024

Filed

Oct 9, 2024

To disclose

16 weeks

Affected

10state residents only

Linked

5 records

Confidence

66%

Full breach record for Fitzgerald, DePietro & Wojnas CPAs, P.C. →

Fitzgerald, DePietro & Wojnas CPAs, P.C. disclosed a ransomware incident discovered on June 19, 2024. A threat actor encrypted files and exfiltrated tax documents containing PII, SSNs, and financial data. The firm engaged forensic counsel, restored backups, and offered IDX identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 16 weeks / 112 days

Jun 19, 2024

Discovered

Oct 9, 2024

Filed

vs. sector median

4 wks faster

This filing is one of 5 records about the same incident.View merged incident

A leak claim by medusa about this victim was first seen 108 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitemedusabd_5f353c840e46a2f02024-06-19 · +112dVerified by operator

Regulatory filings (2) · sorted by filing gap

Vermont State AGbd_71788bca92fc61782024-10-09Verified
Massachusetts State AGbd_c175690325b7fafb2024-10-05 · +4dVerified by operator

Press reports (1)

Pressmedusabd_8741d25aa95b9e272024-06-19 · +112dCandidate

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net

Name: Fitzgerald, DePietro & Wojnas CPAs, P.C.
norm: fitzgerald depietro wojnas cpas pc
Domain: fdwcpa.net
Industry: Professional Servicesllm

Discovered: Jun 19, 2024
Materiality determined: —
Notification sent: Sep 26, 2024
Affected individuals: 10state-resident count only
Data types: Identity (basic)Government IDFinancial accountPII
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Severed the threat actor’s access to our networks
Reset IT passwords
Hardened our network
Restored our files from backups
Deployed software to ensure that the threat actor was out of our system
Engaged cybersecurity counsel and a forensics firm
Offering identity theft protection services through IDX
Changes made: Deployed software to ensure that the threat actor was out of our system
Hardened our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 5 · first

Vermont State AG+4d

Montana State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1753.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 9, 2024
Raw hash: de7446dc855c83928535d8f3df3050a45d77a33b3e38cf684b564ce4ed6ca8e5

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Press reports (1)

Reporting entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Victim entityFitzgerald, DePietro & Wojnas CPAs, P.C.

Incidentdiscovered Jun 19, 2024

Stated responseSevered the threat actor’s access to our networks

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov