Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

PEÑA BRIONES MCDANIEL & CO.

bd_a214ab7508cc6169 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 12, 2025

Filed

Sep 16, 2025

To disclose

27 days

Affected · nationwide

1,7571 in this filing

Linked

8 filings

Confidence

66%

Full breach record for PEÑA BRIONES MCDANIEL & CO. →

Peña Briones McDaniel & Co., PC reported a data breach affecting 1,757 individuals, including 1 Maine resident. Unauthorized access to an employee email account occurred on February 12, 2025, and was discovered on August 20, 2025, following a forensic investigation. The breach likely involved phishing leading to credential compromise. Personal information, including government identifiers, was potentially accessed. Notifications were sent on September 16, 2025, offering 12 months of IDX identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Feb 12, 2025 → Filed with AG Sep 16, 2025216d ✗ ME AG >90d27 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 31 weeks / 216 days

Feb 12, 2025

Begins

Feb 12, 2025

Discovered

Sep 16, 2025

Filed

vs. sector median

15 wks faster

This filing is one of 8 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 154 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_86ae20157535d2f42025-04-15 · +154dVerified by operator

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_14785cd344cbd74e2025-09-16Verified by operator
Indiana State AGbd_3467a3c4bfe299372025-09-16Verified by operator
Texas State AGbd_3ab595440f3c33af2025-09-18 · +2dVerified
Texas State AGbd_99926532cb3762612025-08-19 · +28dVerified

Show 2 more filings ↓up to 39d gap

Massachusetts State AGbd_a118e5d1286cfabe2025-08-18 · +29dVerified by operator
Indiana State AGbd_ec7704e35e424edb2025-08-08 · +39dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: PEÑA BRIONES MCDANIEL & CO.
norm: pena briones mcdaniel
Domain: cpaelpaso.com
Industry: Professional Servicesllm

Discovered: Feb 12, 2025
Breach occurred: Feb 12, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 16, 2025
Affected individuals: 1,757state + nationwide
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Working very closely with external cybersecurity professionals
Conducted extensive forensic investigation and comprehensive document review
Offered complimentary month membership of identity theft protection services through IDX
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: ME AG >90d · 216dME resident >60d · 216dLeak >90d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Feb 12, 2025
→ Filed with AG: Sep 16, 2025
216d 90 days ME AG >90d
Maine
Discovered: Feb 12, 2025
→ Notified: Sep 16, 2025
216d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Feb 12, 2025 → Filed with AG: Sep 16, 2025	216d	90 days	ME AG >90d
Maine	Discovered: Feb 12, 2025 → Notified: Sep 16, 2025	216d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 4 states

View merged incident ↗

Indiana State AGAug 8 · first

Massachusetts State AG+10d

Texas State AG+11d

Massachusetts State AG+39d

Indiana State AG+39d

Maine State AG+39d · this page

Texas State AG+41d

Pattern: first filing Aug 8 (IN), last Sep 18 (TX) — a 41-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/2cf1affe-51cd-4f48-bb4a-ab88d84f3b42.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 16, 2025
Raw hash: 70d4663b275f9d4fa7c944132018073bffa6d314251dd9c9b3eb1d53855087e2

Linked disclosures

Ransomware claims (1)

Regulatory filings (6) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityPEÑA BRIONES MCDANIEL & CO.

Incidentdiscovered Feb 12, 2025

Stated responseCommenced a prompt and thorough investigation

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov