MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedCustomer Data InvolvedRansom DemandedGovernment IDIdentity (basic)MediumContained

Sullivan, Hayes, and Quinn, LLC

bd_a3892e412159756f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 11, 2021

Filed

May 17, 2021

To disclose

5 weeks

Affected

1state residents only

Confidence

68%

Full breach record for Sullivan, Hayes, and Quinn, LLC →

Sullivan, Hayes & Quinn, LLC, a Massachusetts law firm, notified the New Hampshire Attorney General on May 17, 2021, of a ransomware attack discovered on April 11, 2021. The incident potentially exposed the personal information (name, address, SSN) of one New Hampshire resident. No ransom was paid, and no evidence of actual compromise was found. The firm engaged forensic experts, notified employees, and provided 24 months of complimentary identity monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 5 weeks / 36 days

Apr 11, 2021

Discovered

May 17, 2021

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Sullivan, Hayes, and Quinn, LLC
norm: sullivan hayes and quinn
Domain: sullivanandhayes.com

Name: Sullivan, Hayes, and Quinn, LLC
norm: sullivan hayes and quinn
Domain: sullivanandhayes.com
Industry: Professional Servicesllm

Discovered: Apr 11, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Retained a third party computer expert to conduct an investigation of the computer system
Reviewed its internal data management protocols and has implemented enhanced security measures
Notified all of their former and current employees about this incident
Forwarded letters notifying them of this incident
Providing identity monitoring services for 24 months at no cost to the individuals
Changes made: Implemented enhanced security measures to help prevent this type of incident from recurring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/sullivan-hayes-quinn-20210517.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 17, 2021
Raw hash: 65b48b1a6dfe3ff045a4630b1709173b85bcaad3aeb76dc0eedd443d6c4611bb

Reporting entitySullivan, Hayes, and Quinn, LLC

Victim entitySullivan, Hayes, and Quinn, LLC

Incidentdiscovered Apr 11, 2021

Stated responseRetained a third party computer expert to conduct an investigation of the computer system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov