HackingProfessional ServicesProfessional ServicesDelayed DiscoveryPIIIdentity (basic)LowContained

Marshall & Melhorn, LLC

bd_a330133bef4180c8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 14, 2021

Filed

Jun 7, 2023

To disclose

21 months

Affected

14state residents only

Linked

4 filings

Confidence

66%

Full breach record for Marshall & Melhorn, LLC →2 incidents on file

Marshall & Melhorn, LLC notified individuals of a September 14, 2021 network intrusion causing an outage. An unauthorized actor accessed files containing names and data elements. Investigation completed March 6, 2023. Law enforcement notified. Remediation included policy review and enhanced cybersecurity measures. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 months / 631 days

Sep 14, 2021

Begins

Sep 14, 2021

Discovered

Jun 7, 2023

Filed

vs. sector median

+71 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_25e56e830e87027b2023-06-07Verified
Vermont State AGbd_fedf4a0256313e982023-06-07Verified
New Hampshire State AGbd_c0884ed19903020b2023-06-12 · +5dVerified

Name: Marshall & Melhorn, LLC
norm: marshall melhorn
Domain: marshallmelhorn.com

Name: Marshall & Melhorn, LLC
norm: marshall melhorn
Domain: marshallmelhorn.com
Industry: Professional Servicesllm

Discovered: Sep 14, 2021
Breach occurred: Sep 14, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 7, 2023
Affected individuals: 14state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: notified law enforcement and have cooperated in their investigation
Initial access: exploit_public_facing

During the incident: Launched an investigation with the help of computer specialists
Remediated the disruption
Confirmed the security of our systems
Reviewed existing security policies
Implemented additional cybersecurity measures
Notified law enforcement and have cooperated in their investigation
Changes made: Reviewed existing security policies
Implemented additional cybersecurity measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 months(631 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJun 7 · first

Vermont State AGJun 7 · first

Montana State AGJun 7 · first · this page

New Hampshire State AG+5d

Pattern: first filing Jun 7 (OH), last Jun 12 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-338.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2023
Raw hash: 00b09d5426fe36a0579e0c02cdcbd9e97087e2d865e04ac058a686db5e30dc60

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMarshall & Melhorn, LLC

Victim entityMarshall & Melhorn, LLC

Incidentdiscovered Sep 14, 2021

Stated responseLaunched an investigation with the help of computer specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov