HackingProfessional ServicesProfessional ServicesStolen CredentialsCapture App DataCustomer Data InvolvedData ExfiltratedDelayed DiscoveryPIIIDENTITY_GOVERNMENTMediumResolved
Brown, Gruttadaro, & Prato PLLC
bd_a4269a164d13beb1 · schema v1 · pii pii-v1
Full breach record for Brown, Gruttadaro, & Prato PLLC →Brown, Gruttadaro, & Prato PLLC (BGP), a law firm in Rochester, NY, experienced an external email account compromise. An unknown actor gained access to two employee email accounts on or about January 24, 2024. BGP discovered suspicious activity on February 27, 2024. A review completed October 22, 2024, determined that name and Social Security numbers may have been accessed. One Maine resident was notified on December 4, 2024. BGP offered 12 months of IDX credit monitoring.
Maine clockDiscovered Feb 27, 2024 → Filed with AG Dec 4, 2024281d ✗ ME AG >90d40 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f3d64d28-0359-417f-ab1a-4e0b6a66b394.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 4, 2024
- Raw hash
- 307b3296acc315c3eddc3207dd31454b34ebd912aa6f70953994e9c84b7fab7c
Reporting entity
- Name
- Brown, Gruttadaro, & Prato PLLCnorm: brown gruttadaro prato
- Domain
- bgplawfirm.com
- Industry
- Legal Services
Victim entity
- Name
- Brown, Gruttadaro, & Prato PLLCnorm: brown gruttadaro prato
- Domain
- bgplawfirm.com
- Industry
- Legal Services
- Industry
- Professional Servicesllm
Incident
- Discovered
- Feb 27, 2024
- Materiality determined
- —
- Notification sent
- Dec 4, 2024
- Affected individuals
- 1
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Regulator citations
- Maine Attorney General
Compliance
- Time to disclose
- 40 weeks(281 days from discovery to filing)
- Compliance flags
- ME AG >90d · 281dME resident >180d · 281d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 27, 2024→ Filed with AG: Dec 4, 2024281d 90 days ME AG >90d Maine Discovered: Feb 27, 2024→ Notified: Dec 4, 2024281d 180 days ME resident >180d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.