HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHighContained

GPCD Partners, LLC

bd_a04e93e452b934ab · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 5, 2021

Filed

Jul 7, 2021

To disclose

13 weeks

Affected · nationwide

1,5911 in this filing

Linked

3 filings

Confidence

66%

Full breach record for GPCD Partners, LLC →

GPCD Partners, LLC, an accounting firm, notified the NH AG of a cybersecurity incident discovered on April 5, 2021. Unauthorized access to an employee computer potentially exposed PII (names, SSNs, driver's licenses, financial data) of 1,591 clients, including 1 NH resident. GPCD engaged forensic investigators, reset passwords, reimaged systems, and provided 12 months of Kroll identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 93 days

Apr 5, 2021

Discovered

Jul 7, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_28038c0b40e49b172021-07-02 · +5dCandidate
Massachusetts State AGbd_fd1cad46056050bf2021-07-02 · +5dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: GPCD Partners, LLC
norm: gpcd partners
Industry: Professional Servicesllm

Discovered: Apr 5, 2021
Materiality determined: —
Notification sent: Jul 2, 2021
Affected individuals: 1,591state + nationwide
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Changed all passwords
Wiped and re-formatted every computer
Installed network protection programs
Installed Carbon Black, an endpoint monitoring and detection tool
Informed law firm
Began identifying affected individuals in preparation for notice
Arranged for impacted individuals to enroll in identity monitoring services provided by Kroll at no cost for 12 months
Changes made: Changed all passwords
Wiped and re-formatted every computer
Installed network protection programs
Installed Carbon Black, an endpoint monitoring and detection tool
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(93 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Maine State AGJul 2 · first

Massachusetts State AGJul 2 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jul 2 (ME), last Jul 7 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/gpcd-partners-20210707.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2021
Raw hash: 3cb807b2d176d1bf76c19055b55bf48eb69f2c93e0b0245e6925e0ff7b32f7d3

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityGPCD Partners, LLC

Incidentdiscovered Apr 5, 2021

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov