Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)MediumContained

Eichenbaum, Comer & Ratynets

bd_b118da49233dc3aa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2022

Filed

Feb 17, 2022

To disclose

28 days

Affected

Not disclosed

Linked

2 filings

Confidence

63%

Full breach record for Eichenbaum, Comer & Ratynets →2 incidents on file

Eichenbaum Comer & Ratynets AAC disclosed a phishing incident where an unauthorized party accessed an employee email account between October 4 and October 8, 2020. The firm discovered the breach on January 20, 2022, after forensic investigation revealed the accessed account contained personal information, including Social Security numbers. The firm secured the account, engaged external cybersecurity professionals, and is offering one year of complimentary credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 473 days

discovery → filing · 28 days

Oct 4, 2020

Begins

Jan 20, 2022

Discovered

Feb 17, 2022

Filed

vs. sector median

15 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_ad649a1fad5beaa92022-02-17Candidate

Name: Eichenbaum, Comer & Ratynets
norm: eichenbaum comer ratynets
Domain: ecraac.com

Name: Eichenbaum, Comer & Ratynets
norm: eichenbaum comer ratynets
Domain: ecraac.com
Industry: Professional Servicesllm

Discovered: Jan 20, 2022
Breach occurred: Oct 4, 2020 – Oct 8, 2020
Undetected for: 473 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Secured the account
Commenced a prompt and thorough investigation
Worked very closely with external cybersecurity professionals
Offering a complimentary one-year membership of Experian IdentityWorksSM Credit 3B
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGFeb 17 · first

California State AGFeb 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-551061
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 17, 2022
Raw hash: 98ca792786ee06d8ae8755da878923c4ba7a1bb9319f3796300b2addda87def3

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityEichenbaum, Comer & Ratynets

Victim entityEichenbaum, Comer & Ratynets

Incidentdiscovered Jan 20, 2022

Stated responseSecured the account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov