HackingProfessional ServicesProfessional ServicesVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountFinancialMediumContained

Roy & Bentas CPAs, P.C.

bd_a082be9258f00317 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2017

Filed

Feb 24, 2017

To disclose

22 days

Affected

187state residents only

Linked

2 filings

Confidence

64%

Full breach record for Roy & Bentas CPAs, P.C. →

Roy & Bentas CPAs, P.C. notified NH AG of a cyber attack on its ShareFile portal. Unauthorized access occurred Feb 1-2, 2017, exposing personal info of 187 NH residents including names, addresses, SSNs, and tax/financial data. R&B fixed vulnerabilities, removed malicious code, changed passwords, and notified law enforcement. Affected individuals were advised to place credit freezes and offered reimbursement for associated costs.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 22 days

Feb 1, 2017

Begins

Feb 2, 2017

Discovered

Feb 24, 2017

Filed

vs. sector median

14 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_389b5d935cca7c0f2017-02-27 · +3dVerified

Name: Warner Coleman & Goggin, A Professional Corporation
norm: warner coleman goggin a

Name: Roy & Bentas CPAs, P.C.
norm: roy bentas cpas
Industry: Professional Servicesllm

Discovered: Feb 2, 2017
Breach occurred: Feb 1, 2017 – Feb 2, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2017
Affected individuals: 187state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Attorney General of New Hampshire
Initial access: exploit_public_facing

During the incident: Worked quickly to fix the vulnerability
Removed malicious code
Changed all affected passwords
Reported the incident to the local police
Reviewing its internal policies and data management protocols
Attempting to obtain a personal identification number from the Internal Revenue Service for the affected individuals
Recommended to the affected individuals that they place a security freeze on their credit accounts
Provided individuals with information to place a security freeze
Advised that it is available to answer questions or assist any of the affected individuals with the process of obtaining a security freeze
Reimbursing all affected individuals for costs related to placing, temporarily lifting, or permanently removing a security freeze for the next two years
Changes made: Implementing enhanced security measures to help prevent this type of incident from recurring in the future
Continuing to investigate this matter thoroughly
Remediating any vulnerabilities that may be found
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGFeb 24 · first · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/roy-bentas-20170224.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 24, 2017
Raw hash: 2ab1fe1e7fc5a5f43e93f4e0f4a5cfb4d4027d7f0963579976d1e4e9ad888ce4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWarner Coleman & Goggin, A Professional Corporation

Victim entityRoy & Bentas CPAs, P.C.

Incidentdiscovered Feb 2, 2017

Stated responseWorked quickly to fix the vulnerability

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov