MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedRansom DemandedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Crockett & Myers Associates

bd_aa657e824cca8329 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 10, 2022

Filed

Feb 21, 2023

To disclose

15 weeks

Affected

3state residents only

Linked

3 filings

Confidence

66%

Full breach record for Crockett & Myers Associates →

Crockett & Myers Associates experienced a ransomware attack starting November 8, 2022, discovered November 10, 2022. The incident resulted in unauthorized access to files containing names and Social Security numbers of 3 New Hampshire residents. The company engaged forensic specialists, notified federal law enforcement, and sent notices with 12 months of credit monitoring to affected individuals on February 15, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 15 weeks / 103 days

Nov 8, 2022

Begins

Nov 10, 2022

Discovered

Jan 15, 2023

Scope determined

Feb 21, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_fe34016e375326f22023-02-22 · +1dVerified
Indiana State AGbd_3216c77cae49b2cb2023-02-15 · +6dVerified

Name: Crockett & Myers Associates
norm: crockett myers associates

Name: Crockett & Myers Associates
norm: crockett myers associates
Industry: Professional Servicesllm

Discovered: Nov 10, 2022
Breach occurred: Nov 8, 2022
Undetected for: 2 daysoccurrence → discovery
Materiality determined: Jan 15, 2023
Notification sent: Feb 15, 2023
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: reported this incident to federal law enforcement

During the incident: Secured its network
Took the impacted system offline
Engaged third-party forensic specialists to investigate the nature and scope of the incident
Reported this incident to federal law enforcement
Undertook a comprehensive and time-intensive process to identify the information that may have been contained within the potentially impacted files
Provided written notice of this incident to the potentially impacted New Hampshire residents
Offered complimentary credit monitoring and identity protection services for twelve (12) months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(103 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGFeb 15 · first

New Hampshire State AG+6d · this page

Massachusetts State AG+7d

Pattern: first filing Feb 15 (IN), last Feb 22 (MA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/crockett-myers-associates-20230221.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 21, 2023
Raw hash: ce48477b9e6bbb0088b8c41a7428cb7c6628a21ed49f147ecbc88ce96fe289c1

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCrockett & Myers Associates

Victim entityCrockett & Myers Associates

Incidentdiscovered Nov 10, 2022

Stated responseSecured its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov