HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)LowContained

Brown & Streza, LLP

bd_9cf9bf5bf5fe645c · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 18, 2023

Filed

May 12, 2023

To disclose

16 weeks

Affected

30state residents only

Linked

9 filings

Confidence

66%

Full breach record for Brown & Streza, LLP →

Brown & Streza, LLP notified Montana residents of a data breach discovered on January 18, 2023, where an unknown actor gained unauthorized access to its network. The incident may have involved names and other personal information. The firm engaged forensic experts, reported to law enforcement, and offered 12 months of Experian IdentityWorks services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 114 days

Jan 18, 2023

Discovered

May 12, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelosttrustbd_f929cda0efe9b7eb2023-09-26 · +137dVerified by operator

Regulatory filings (7) · sorted by filing gap

Vermont State AGbd_0663a08426d271252023-05-12Verified by operator
Massachusetts State AGbd_57809da712dfd9f22023-05-12Verified by operator
Indiana State AGbd_80bcc587bca48cf82023-05-12Verified by operator
California State AGbd_a3fdea8d506e32402023-05-12Verified by operator

Show 3 more filings ↓up to 224d gap

Massachusetts State AGbd_006b1d203b6c9d072023-12-22 · +224dVerified
California State AGbd_4007dc1bfdd337302023-12-22 · +224dVerified
Montana State AGbd_807d8fea0e6122fd2023-12-22 · +224dCandidate

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com

Name: Brown & Streza, LLP
norm: brown streza
Domain: brownandstreza.com
Industry: Professional Servicesllm

Discovered: Jan 18, 2023
Materiality determined: —
Notification sent: May 12, 2023
Affected individuals: 30state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reported the incident to law enforcement
Initial access: valid_credentials

During the incident: Reported the incident to law enforcement
Implemented additional security measures
Took immediate steps to ensure our network was secure
Launched a forensic investigation
Undertook a comprehensive review of the potentially impacted data
Offering you complimentary identity protection services through Experian IdentityWorks
Changes made: Implemented additional security measures to reduce the risk of future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(114 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 5 states

View merged incident ↗

Vermont State AGMay 12 · first

Massachusetts State AGMay 12 · first

Indiana State AGMay 12 · first

California State AGMay 12 · first

Montana State AGMay 12 · first · this page

Massachusetts State AG+224d

California State AG+224d

Montana State AG+224d

Pattern: first filing May 12 (VT), last Dec 22 (MT) — a 224-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-276.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2023
Raw hash: 9033758bb84986d7de88acee9948aa4f78c952ef93ac082d6abb09d17380938d

Linked disclosures

Ransomware claims (1)

Regulatory filings (7) · sorted by filing gap

Reporting entityBrown & Streza, LLP

Victim entityBrown & Streza, LLP

Incidentdiscovered Jan 18, 2023

Stated responseReported the incident to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov