HackingProfessional ServicesProfessional ServicesStolen CredentialsDelayed DiscoveryCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Edgar & Associates LLP

bd_a47b878a81e3257d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 13, 2017

Filed

Apr 6, 2017

To disclose

24 days

Affected

Not disclosed

Confidence

64%

Full breach record for Edgar & Associates LLP →

Edgar & Associates LLP experienced unauthorized access to its systems via Remote Desktop Protocol. Hackers gained access from a foreign IP address. The breach occurred in two windows: April 1-2, 2016, and September 28-November 3, 2016. The company discovered the incident on March 13, 2017, after detecting unusual activity and rejected tax returns. Affected data included names, SSNs, DOBs, addresses, employment info (W-2s, 1099s), and bank account details. The firm notified law enforcement (FBI, IRS, FTB) and credit bureaus, and offered 12 months of identity repair and credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 13, 2017 → Notified Apr 6, 201724d ✓ CA 60-day OK24 days discovery → filing

Incident timeline

undetected · 346 days

discovery → filing · 24 days

Apr 1, 2016

Begins

Mar 13, 2017

Discovered

Apr 6, 2017

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Edgar & Associates LLP
norm: edgar associates

Name: Edgar & Associates LLP
norm: edgar associates
Industry: Professional Servicesllm

Discovered: Mar 13, 2017
Breach occurred: Apr 1, 2016 – Nov 3, 2016
Undetected for: 346 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 6, 2017
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified the FBINotified the IRSNotified the FTBNotified all applicable state agencies
Initial access: external_remote_services

During the incident: Hired IT consultants to investigate
Hired a specialized forensic IT firm
Notified the FBI
Notified the IRS
Notified the FTB
Notified all three credit bureaus
Notified all applicable state agencies
Notified local law enforcement
Reviewing office policies and procedures to ensure all security measures are taken to avoid such an incident from occurring again
Working with law enforcement
Changes made: Reviewing office policies and procedures to ensure all security measures are taken to avoid such an incident from occurring again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: CA 60-day OK · 24d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 13, 2017
→ Notified: Apr 6, 2017
24d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 13, 2017 → Notified: Apr 6, 2017	24d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-67343
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2017
Raw hash: d264716cd182c91c85a893402a1317495e331a7e2d8e21b8c09610fab453c7d0

Reporting entityEdgar & Associates LLP

Victim entityEdgar & Associates LLP

Incidentdiscovered Mar 13, 2017

Stated responseHired IT consultants to investigate

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov