Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsTargetedIdentity (basic)Government IDHealth (basic)PHIMediumContained

Chapman and Cutler LLP

bd_b90ff89eb53b89f7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 7, 2018

Filed

Aug 20, 2018

To disclose

24 weeks

Affected

1state residents only

Linked

2 filings

Confidence

67%

Full breach record for Chapman and Cutler LLP →

Chapman & Chapman, Inc. notified the NH AG of a March 7, 2018 email compromise affecting 1 NH resident. Data accessed included names, DOBs, SSNs, insurance/Medicare numbers, and limited health info. Remediation included MFA, password policies, and forensic investigation. One-year Kroll identity monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 weeks / 166 days

Mar 7, 2018

Discovered

Aug 20, 2018

Filed

vs. sector median

+6 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_abffab074c4bcee02018-08-17 · +3dVerified

Name: Chapman and Cutler LLP
norm: chapman and cutler
Domain: chapman.com

Name: Chapman and Cutler LLP
norm: chapman and cutler
Domain: chapman.com
Industry: Professional Servicesllm

Discovered: Mar 7, 2018
Materiality determined: —
Notification sent: Aug 16, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Notified its Information Technology vendor of the incident
Retained a computer forensic company and conducted a detailed forensic investigation
Notified the credit reporting agencies
Changes made: Updating its retention rules to ensure that emails are not kept any longer than necessary
Training its staff to remove any unnecessary personal information
Enabled dual-factor authentication
Implemented a 90-day forced password change policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(166 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRAug 17 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/chapman-20180820.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 20, 2018
Raw hash: fc8074382ebcd7a227b4efcf345a8456f0b9e94fb017a07fd1d0ecac6c6dc28b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityChapman and Cutler LLP

Victim entityChapman and Cutler LLP

Incidentdiscovered Mar 7, 2018

Stated responseNotified its Information Technology vendor of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov