HackingFinancial ServicesProfessional ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Allied CPAs

bd_b8c1862f70c67b4c · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 22, 2024

Filed

Oct 4, 2024

To disclose

15 weeks

Affected · nationwide

11,9226 in this filing

Linked

6 filings

Confidence

67%

Full breach record for Allied CPAs →

Allied CPAs, P.C. reported a data breach affecting 11,922 individuals, including 6 Maine residents. On June 22, 2024, suspicious activity led to the discovery that an unauthorized actor accessed an employee's email and tax software. Compromised data included names, SSNs, driver's licenses, DOBs, and financial account info. Notices were sent on October 4, 2024, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 22, 2024 → Filed with AG Oct 4, 2024104d ✗ ME AG >90d15 weeks discovery → filing

Incident timeline

discovery → filing · 15 weeks / 104 days

Jun 22, 2024

Discovered

Oct 4, 2024

Filed

vs. sector median

+6 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_16742062591dea592024-10-04Verified
New Hampshire State AGbd_351fa148c3762d2b2024-10-04Verified
Massachusetts State AGbd_678749b6c56b203c2024-10-04Verified
Indiana State AGbd_707ed76a63e8fa292024-10-04Verified

Show 1 more filing ↓

Vermont State AGbd_8e071145f4e0291d2024-10-04Verified

Name: Allied CPAs
norm: allied cpas
Domain: alliedfp.com
Industry: Financial Services

Name: Allied CPAs
norm: allied cpas
Domain: alliedfp.com
Industry: Financial Services
Industry: Financial ServicesllmProfessional Servicesllm

Discovered: Jun 22, 2024
Materiality determined: —
Notification sent: Oct 4, 2024
Affected individuals: 11,922state + nationwide
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Provided written notice to relevant state regulatorsNotified the three major credit reporting agencies, Equifax, Experian, and TransUnion
Initial access: phishing_link

During the incident: Launched an investigation with the assistance of third-party forensic specialists
Notified law enforcement
Enhanced its existing security protocols
Provided individuals with access to credit monitoring services for one year through CyberScout
Provided written notice to relevant state regulators and to the three major credit reporting agencies
Changes made: Enhanced its existing security protocols
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: ME AG >90d · 104d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 22, 2024
→ Filed with AG: Oct 4, 2024
104d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 22, 2024 → Filed with AG: Oct 4, 2024	104d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGOct 4 · first

New Hampshire State AGOct 4 · first

Massachusetts State AGOct 4 · first

Indiana State AGOct 4 · first

Vermont State AGOct 4 · first

Maine State AGOct 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/21689b6f-ce55-4508-94f9-8c205c61f10a.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 4, 2024
Raw hash: 8e2fb9f7f5c5b5fedd8ba5b3152bb6ac30e55ce58b18980859219d01deced2e4

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityAllied CPAs

Victim entityAllied CPAs

Incidentdiscovered Jun 22, 2024

Stated responseLaunched an investigation with the assistance of third-party forensic specialists

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov