HackingProfessional ServicesProfessional ServicesStolen CredentialsPhishingCustomer Data InvolvedTargetedIdentity (basic)Government IDFinancial accountHealth (basic)PHIMediumContained

White & Associates

bd_b5b9280172a33b8d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 25, 2021

Filed

Mar 28, 2022

To disclose

39 weeks

Affected

2state residents only

Linked

5 filings

Confidence

67%

Full breach record for White & Associates →

White & Associates, a CPA firm, notified the NH Attorney General of a cybersecurity incident discovered on June 25, 2021, involving unauthorized access to an employee email account. The breach potentially exposed PII, SSNs, financial data, and health info of 2 NH residents. White & Associates engaged forensic investigators, reset credentials, and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 39 weeks / 276 days

Jun 25, 2021

Discovered

Mar 28, 2022

Filed

vs. sector median

+21 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_08201068d1f563bb2022-03-21 · +7dCandidate
Indiana State AGbd_1ab62634934202f92022-03-21 · +7dVerified
Montana State AGbd_22572f2ac05e635c2022-03-21 · +7dVerified
Massachusetts State AGbd_cfe03e4f947323b12022-03-21 · +7dVerified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: White & Associates
norm: white associates
Industry: Professional Servicesllm

Discovered: Jun 25, 2021
Materiality determined: —
Notification sent: Mar 21, 2022
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: phishing_link

During the incident: Engaged a specialized cybersecurity firm to conduct a forensic investigation
Changed the password to the compromised employee’s account
Engaged a data mining vendor to identify the individuals whose sensitive information was stored in the compromised account
Engaged a third party vendor to assist with mailing notices
Set up a call center to answer questions regarding the incident
Provided credit monitoring and identity theft protection services to all affected parties at no cost
Changes made: Offered twelve (12) months of complimentary credit monitoring and identity theft restoration services through Cyberscout
Provided guidance on how to better protect against identity theft and fraud, including providing information on how to place a fraud alert and security freeze on one’s credit file
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(276 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maine State AGMar 21 · first

Indiana State AGMar 21 · first

Montana State AGMar 21 · first

Massachusetts State AGMar 21 · first

New Hampshire State AG+7d · this page

Pattern: first filing Mar 21 (ME), last Mar 28 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/white-associates-20220328.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 28, 2022
Raw hash: 32901c50f0e994efd5349d318e0c946ba0b322f3a637618631d3c15b5bd05bf4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityWhite & Associates

Incidentdiscovered Jun 25, 2021

Stated responseEngaged a specialized cybersecurity firm to conduct a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov