HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)Government IDPIIMediumContained

M. Green and Company LLP

bd_b27e46fa3bee140c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 14, 2022

Filed

Oct 13, 2022

To disclose

13 weeks

Affected

3state residents only

Linked

5 filings

Confidence

66%

Full breach record for M. Green and Company LLP →

M. Green and Company LLP notified Montana residents of a data breach discovered on July 14, 2022, where an unauthorized user accessed personal information including names, SSNs, and DOB. The firm engaged forensic consultants, changed passwords, and notified law enforcement and the IRS.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 91 days

Jul 14, 2022

Discovered

Oct 13, 2022

Filed

vs. sector median

6 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitequantumbd_169c938d4ab7098a2022-06-14 · +120dVerified by operator

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_57c4339d1ce498ab2022-10-13Verified by operator
California State AGbd_a8912d3286b44cca2022-10-13Verified
Indiana State AGbd_15f69d3303268d582022-10-12 · +1dVerified by operator

Name: M. Green and Company LLP
norm: m green and
Domain: mgreencpas.com

Name: M. Green and Company LLP
norm: m green and
Domain: mgreencpas.com
Industry: Professional Servicesllm

Discovered: Jul 14, 2022
Materiality determined: —
Notification sent: Sep 19, 2022
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal and local law enforcementWorking with the Internal Revenue Service (IRS)
Initial access: valid_credentials

During the incident: Engaged a forensic IT consultant
Undertook a diligent and thorough review of the impacted documents
Immediate enhancements to systems and security practices implemented
Passwords changed
Engaged experts to assist in conducting a full review of security practices and systems
Notified federal and local law enforcement
Working with the IRS
Changes made: Implemented network firewalls
Ensured appropriate security protocols are in place and properly functioning
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(91 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 12 · first

Massachusetts State AG+1d

California State AG+1d

Montana State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2022
Raw hash: 061f41bb0ed75fc75a507ab15025950c7cbb5965e55aeb152070fecfd64140e3

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityM. Green and Company LLP

Victim entityM. Green and Company LLP

Incidentdiscovered Jul 14, 2022

Stated responseEngaged a forensic IT consultant

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov