HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

Miller Kaplan Arase, LLP

bd_a295f1709ecb68e7 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 22, 2019

Filed

Sep 11, 2019

To disclose

25 weeks

Affected

7,442state residents only

Linked

4 filings

Confidence

64%

Full breach record for Miller Kaplan Arase, LLP →

Miller Kaplan Arase LLP experienced unauthorized access to an employee's email account on March 22, 2019. The incident potentially exposed personal information including names, addresses, SSNs, dates of birth, financial account numbers, and health information for approximately 7,442 California residents. The firm engaged forensic investigators, notified law enforcement, and implemented MFA and password resets. Affected individuals were offered 36 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 22, 2019 → Notified Jul 10, 2019110d ✗ CA 60-day late25 weeks discovery → filing

Incident timeline

discovery → filing · 25 weeks / 173 days

Mar 22, 2019

Begins

Mar 22, 2019

Discovered

Sep 11, 2019

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4f10e00deda866be2019-07-10 · +63dVerified
California State AGbd_8a229e0f9ef9779a2019-07-10 · +63dVerified
Montana State AGbd_e476626cdbaaecf22019-07-10 · +63dCandidate

Name: Miller Kaplan Arase, LLP
norm: miller kaplan arase

Name: Miller Kaplan Arase, LLP
norm: miller kaplan arase
Industry: Professional Servicesllm

Discovered: Mar 22, 2019
Breach occurred: Mar 22, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 10, 2019
Affected individuals: 7,442state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified California Attorney General on July 10, 2019Reported to the FBIReported to local law enforcement
Initial access: valid_credentials

During the incident: Took steps to secure all MKA email accounts
Engaged an independent forensics firm to determine what happened and to conduct an extensive review of the email account
Reported this matter to the FBI and to local law enforcement
Resetting account passwords
Implementing multi-factor authentication for remote email access
Provided employees additional training
Offering complimentary credit monitoring and identity protection services through ID Experts’ MyIDCare for 36 months
Changes made: Implementing multi-factor authentication for remote email access
Provided employees additional training
Reviewing its policies and procedures to further enhance the security of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(173 days from discovery to filing)
Compliance flags: CA 60-day late · 110d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 22, 2019
→ Notified: Jul 10, 2019
110d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 22, 2019 → Notified: Jul 10, 2019	110d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGJul 10 · first

California State AGJul 10 · first

Montana State AGJul 10 · first

California State AG+63d · this page

Pattern: first filing Jul 10 (MA), last Sep 11 (CA) — a 63-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-150465
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2019
Raw hash: 5c13a42669328f902b4d36b07e31f1d86ab4c899a2a3533ef0e64c4342288f1b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMiller Kaplan Arase, LLP

Victim entityMiller Kaplan Arase, LLP

Incidentdiscovered Mar 22, 2019

Stated responseTook steps to secure all MKA email accounts

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov