Social EngineeringPhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Steven Miller & Co. LLC

bd_a27c7858cfaad7f9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 8, 2024

Filed

Jan 29, 2025

To disclose

29 weeks

Affected

5state residents only

Linked

5 filings

Confidence

67%

Full breach record for Steven Miller & Co. LLC →

Steven Miller & Co. LLC notified the Maryland AG of a data breach impacting 5 Maryland residents. On July 8, 2024, an unauthorized actor accessed a web-based accounting platform via a phishing scam, acquiring names, SSNs, and driver's licenses. The company engaged forensic specialists, notified affected individuals on Jan 21, 2025, and offered 12 months of credit monitoring. Remediation included MFA implementation and password resets.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d29 weeks discovery → filing

Incident timeline

discovery → filing · 29 weeks / 205 days

Jul 8, 2024

Discovered

Jan 29, 2025

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_8138ad48c954de232025-01-29Candidate
Massachusetts State AGbd_8967c7aee08742222025-01-29Verified
New Hampshire State AGbd_c66c03f8089ac5972025-01-27 · +2dVerified
Indiana State AGbd_c7eb88ee1f2b35582025-01-21 · +8dVerified

Name: Steven Miller & Co. LLC
norm: steven miller

Name: Steven Miller & Co. LLC
norm: steven miller

Discovered: Jul 8, 2024
Materiality determined: —
Notification sent: Jan 21, 2025
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Maryland Attorney General
Initial access: phishing_link

During the incident: Initiated an investigation with the assistance of our firm and third-party IT specialists
Notified those individuals on January 21, 2025
Offered the opportunity to enroll of 12 months of complimentary credit monitoring
A dedicated call center of trained professionals has been made available to provide support services
Changes made: Implemented multi-factor authentication for all end-users
Initiated a mandatory password reset
Implemented security tools
Revised its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(205 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJan 21 · first

New Hampshire State AG+6d

Maine State AG+8d

Massachusetts State AG+8d

Maryland State AG+8d · this page

Pattern: first filing Jan 21 (IN), last Jan 29 (MD) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376259.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 29, 2025
Raw hash: 4583defc6136483fed3bd4240a641a7a0d7cc8703c9326df2e53bd95c0559470

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entitySteven Miller & Co. LLC

Victim entitySteven Miller & Co. LLC

Incidentdiscovered Jul 8, 2024

Stated responseInitiated an investigation with the assistance of our firm and third-party IT specialists

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov