HackingProfessional ServicesHealthcareProfessional ServicesStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedBusiness Associate (HIPAA)Downstream VictimsIdentity (basic)Government IDHealth (basic)Financial accountMediumActive

Zumpano Patricios, P.A.

bd_9c81cf321a6eb66d · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 6, 2025

Filed

Jul 3, 2025

To disclose

8 weeks

Affected

2state residents only

Linked

4 filings

Confidence

67%

Full breach record for Zumpano Patricios, P.A. →

Zumpano Patricios, P.A. (ZP Law), a law firm acting as a business associate for healthcare providers, notified the NH AG of a cyber-attack intrusion detected on May 6, 2025. An unauthorized third party accessed and potentially exfiltrated files containing patient PII (SSN, DOB, names) and PHI. ZP Law changed passwords, blocked access, engaged forensic experts, and notified law enforcement. Two NH residents are affected. ZP Law is offering credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 58 days

May 6, 2025

Discovered

Jul 3, 2025

Filed

vs. sector median

11 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_f6cce678991d7afa2025-07-03Verified
Indiana State AGbd_7c11fa2a34694b4c2025-07-11 · +8dVerified
Massachusetts State AGbd_d0015cc268eda0932025-07-16 · +13dVerified

Name: Zumpano Patricios, P.A.
norm: zumpano patricios

Name: Zumpano Patricios, P.A.
norm: zumpano patricios
Industry: Professional ServicesllmHealthcarellm

Discovered: May 6, 2025
Materiality determined: —
Notification sent: Jul 3, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Passwords were promptly changed
The unauthorized access was blocked
Engaged third-party forensic experts to investigate and remediate this incident
Law enforcement has been notified
Changes made: Offering you access to complimentary credit monitoring and identity theft protection services through IDX
Taking steps to enhance its security measures to help reduce the risk of something like this happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJul 3 · first

New Hampshire State AGJul 3 · first · this page

Indiana State AG+8d

Massachusetts State AG+13d

Pattern: first filing Jul 3 (FL), last Jul 16 (MA) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/zumpano-patricios-20250703.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 3, 2025
Raw hash: c048b32279c152bc26d0c7cc86c59db4b519d597b5797660730809f38f69ebb0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityZumpano Patricios, P.A.

Victim entityZumpano Patricios, P.A.

Incidentdiscovered May 6, 2025

Stated responsePasswords were promptly changed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov