HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Witherspoon Brajcich McPhee PLLC

bd_9a3537584cacda2f · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 1, 2024

Filed

Nov 15, 2024

To disclose

37 weeks

Affected

6,419state residents only

Linked

2 filings

Confidence

69%

Full breach record for Witherspoon Brajcich McPhee PLLC →

Supplemental notice for Witherspoon Brajcich McPhee, PLLC regarding unauthorized access to systems between Jan 5 and Mar 1, 2024. Discovered Mar 1, 2024. Affected WA residents' PII including SSN, driver's license, and financial data. 6,419 residents notified. Federal law enforcement notified; credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d37 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 56 days

discovery → filing · 37 weeks / 259 days

Jan 5, 2024

Begins

Mar 1, 2024

Discovered

Nov 15, 2024

Filed

vs. sector median

+17 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Montana State AGbd_c66aa3ea580d2ddc2024-08-30 · +77dCandidate

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Witherspoon Brajcich McPhee PLLC
norm: witherspoon brajcich mcphee
Industry: Professional Servicesllm

Discovered: Mar 1, 2024
Breach occurred: Jan 5, 2024 – Mar 1, 2024
Undetected for: 56 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 30, 2024
Affected individuals: 6,419state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the event to federal law enforcementProviding written notice of this event to appropriate privacy regulators

During the incident: Initiated a comprehensive investigation with assistance from external computer forensic specialists
Undertook an extensive review of the data at risk
Reported the event to federal law enforcement
Provided written notice of this event to appropriate privacy regulators and to the three major consumer reporting agencies
Providing access to credit monitoring and identity restoration services for 12 months, through Epiq
Established a toll-free assistance line to address any questions from notified individuals
Changes made: Working to implement additional technical and administrative safeguards
Cybersecurity training to its employees
Reviewing and enhancing policies and procedures as appropriate
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(259 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Montana State AGAug 30 · first

Washington State AG+77d · this page

Pattern: first filing Aug 30 (MT), last Nov 15 (WA) — a 77-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA31394.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2024
Raw hash: 148c7e2a26dafd8ce2c064f94f4ba2766565c13217d110208a995e7109fe6a07

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityWitherspoon Brajcich McPhee PLLC

Incidentdiscovered Mar 1, 2024

Stated responseInitiated a comprehensive investigation with assistance from external computer forensic specialists

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com