HackingTargetedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Fox & Company CPAs, Inc.
bd_a8f75c1e0bdd2e5a · schema v1 · pii pii-v1
Full breach record for Fox & Company CPAs, Inc. →Fox & Company CPAs, Inc. notified consumers of a data breach where an unauthorized third party accessed files via Citrix’s ShareFile system on July 13, 2023. The incident involved personal information including names and government identifiers from recent tax returns. The company notified the FBI and IRS, and offered one year of Equifax credit monitoring.
Vermont clock⏱ VT AG >14 bday7 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-08-28-fox-and-company-cpas-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 28, 2023
- Raw hash
- 699df881e5f3470c07d408a17efae6969793c27e503c128534635b5fcfec2356
Reporting entity
- Name
- Fox & Company CPAs, Inc.norm: fox company cpas
Victim entity
- Name
- Fox & Company CPAs, Inc.norm: fox company cpas
Incident
- Discovered
- Jul 13, 2023
- Materiality determined
- —
- Notification sent
- Aug 28, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified the FBIWorked with IRS to enroll affected individuals in the IRS Taxpayer Protection Program
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(46 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.