Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsBECData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsCredentialsMediumContained

Karr & Boucher, PLLC

bd_9d8eed3c61a23b5c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 12, 2025

Filed

Jan 7, 2026

To disclose

21 weeks

Affected · nationwide

482 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Karr & Boucher, PLLC →

Karr & Boucher, P.L.L.C., a tax preparation service provider, reported a business email compromise discovered on August 12, 2025. The incident affected 48 individuals, including 2 Maine residents. Compromised data included names, SSNs, and financial account credentials. The firm engaged forensic investigators, secured accounts, enhanced security measures, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 12, 2025 → Filed with AG Jan 7, 2026148d ✗ ME AG >90d21 weeks discovery → filing

Incident timeline

discovery → filing · 21 weeks / 148 days

Aug 12, 2025

Begins

Aug 12, 2025

Discovered

Jan 7, 2026

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_8bd008203102e5132026-01-07Verified
New Hampshire State AGbd_f593a2f94389b8332026-01-07Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: Karr & Boucher, PLLC
norm: karr boucher
Domain: karrboucher.com
Industry: Professional Servicesllm

Discovered: Aug 12, 2025
Breach occurred: Aug 12, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 7, 2026
Affected individuals: 48state + nationwide
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsCredentials
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Maine Attorney General
Initial access: phishing_link

During the incident: Secured the email account
Engaged a third-party cybersecurity firm to conduct a forensic investigation
Conducted a thorough review of the emails and files that were accessed
Enhanced technical security measures and procedures
Offered 12 months of complimentary credit monitoring and identity theft restoration services through Kroll
Changes made: Enhanced technical security measures and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(148 days from discovery to filing)
Compliance flags: ME AG >90d · 148dME resident >60d · 148d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 12, 2025
→ Filed with AG: Jan 7, 2026
148d 90 days ME AG >90d
Maine
Discovered: Aug 12, 2025
→ Notified: Jan 7, 2026
148d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 12, 2025 → Filed with AG: Jan 7, 2026	148d	90 days	ME AG >90d
Maine	Discovered: Aug 12, 2025 → Notified: Jan 7, 2026	148d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGJan 7 · first

New Hampshire State AGJan 7 · first

Maine State AGJan 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a0d6d970-17bd-4c47-8aa8-a3caf4150eaa.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 7, 2026
Raw hash: b0ba46c4782a1e40f6aa934b4c398da4764ca59633f7e3086dece4865b8baae1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityKarr & Boucher, PLLC

Incidentdiscovered Aug 12, 2025

Stated responseSecured the email account

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov