HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPIIGovernment IDHigh

SMITH GAMBRELL & RUSSELL LLP

bd_a79f772ed3679018 · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 9, 2021

Filed

Aug 8, 2022

To disclose

52 weeks

Affected · nationwide

19,3228 in this filing

Linked

6 filings

Confidence

63%

Full breach record for SMITH GAMBRELL & RUSSELL LLP →6 incidents on file

The law firm Smith, Gambrell & Russell, LLP experienced an external system breach on August 9, 2021, discovered the same day. The breach compromised the names and Social Security numbers of 19,322 individuals. The firm notified affected individuals on August 8, 2022, and offered 12 months of credit monitoring and identity restoration services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Aug 9, 2021 → Filed with AG Aug 8, 2022364d ✗ ME AG >90d52 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 52 weeks / 364 days

Aug 9, 2021

Begins

Aug 9, 2021

Discovered

Aug 8, 2022

Filed

vs. sector median

+34 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_2b7bfafa570976dc2022-06-28 · +41dVerified
Montana State AGbd_eddc405cf41305702022-06-28 · +41dCandidate
Washington State AGbd_be4969b025e7c48d2022-12-13 · +127dVerified
Vermont State AGbd_37ca2b6de1bd12f42023-01-27 · +172dVerified

Show 1 more filing ↓up to 205d gap

California State AGbd_4870caeeb4e8f2162023-03-01 · +205dVerified

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com
Industry: Professional Servicesllm

Discovered: Aug 9, 2021
Breach occurred: Aug 9, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2022
Affected individuals: 19,322state + nationwide
Data types: PIIGovernment ID
Data elements: Social Security number
Attack vector: Unauthorized Access
Threat actor: External

During the incident: Offered 12 months of credit monitoring and identity restoration services through IDX
Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 52 weeks(364 days from discovery to filing)
Compliance flags: ME AG >90d · 364dME resident >180d · 364d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Aug 9, 2021
→ Filed with AG: Aug 8, 2022
364d 90 days ME AG >90d
Maine
Discovered: Aug 9, 2021
→ Notified: Aug 8, 2022
364d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Aug 9, 2021 → Filed with AG: Aug 8, 2022	364d	90 days	ME AG >90d
Maine	Discovered: Aug 9, 2021 → Notified: Aug 8, 2022	364d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGJun 28 · first

Montana State AGJun 28 · first

Maine State AG+41d · this page

Washington State AG+168d

Vermont State AG+213d

California State AG+246d

Pattern: first filing Jun 28 (ME), last Mar 1 (CA) — a 246-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/df81bbd1-bc75-4a43-8141-71de14f7760d.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 8, 2022
Raw hash: 37ac97720ad3cf247b6869f5a3b47ff2911e0ceda32dbaf47c29a041a6fc03f0

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySMITH GAMBRELL & RUSSELL LLP

Victim entitySMITH GAMBRELL & RUSSELL LLP

Incidentdiscovered Aug 9, 2021

Stated responseOffered 12 months of credit monitoring and identity restoration services through IDX

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov