HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumActive

McElroy, Deutsch, Mulvaney & Carpenter LLP

bd_bd3f74df05a359e3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2025

Filed

Dec 19, 2025

To disclose

37 weeks

Affected

1state residents only

Linked

6 filings

Confidence

66%

Full breach record for McElroy, Deutsch, Mulvaney & Carpenter LLP →

McElroy, Deutsch, Mulvaney & Carpenter LLP (MDMC) notified the New Hampshire Attorney General of a cyberattack affecting one NH resident. Unauthorized access to MDMC systems occurred March 28–April 1, 2025. MDMC detected suspicious activity on April 3, 2025, and confirmed on December 4, 2025, that names and Social Security numbers were accessed. MDMC notified federal law enforcement, provided 12 months of credit monitoring via Epiq, and is reviewing security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 37 weeks / 260 days

Mar 28, 2025

Begins

Apr 3, 2025

Discovered

Dec 19, 2025

Filed

vs. sector median

+18 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_698f1a0d029620162025-12-19Verified
Nebraska State AGbd_6da1ae289ac345962025-12-19Verified
Maine State AGbd_efd18d3b3c3e05362025-12-19Candidate
New Hampshire State AGbd_03b000a29a602b0c2026-03-12 · +83dCandidate

Show 1 more filing ↓up to 83d gap

Maine State AGbd_df428c93170c98cf2026-03-12 · +83dVerified

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Professional Servicesllm

Discovered: Apr 3, 2025
Breach occurred: Mar 28, 2025 – Apr 1, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General Consumer Protection & Antitrust Bureau
Initial access: exploit_public_facing

During the incident: Notified federal law enforcement regarding the event
Providing access to credit monitoring services for twelve (1) months, through Epiq, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Reviewing its policies and procedures to reduce the likelihood of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(260 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Indiana State AGDec 19 · first

Nebraska State AGDec 19 · first

Maine State AGDec 19 · first

New Hampshire State AGDec 19 · first · this page

New Hampshire State AG+83d

Maine State AG+83d

Pattern: first filing Dec 19 (IN), last Mar 12 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/mcelroy-deutsch-mulvaney-carpenter-20251219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: 2b5a5fbab1cdefe3ced489aab84d6241d00029e9cebe1eb03213fb1fb9d0083b

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Victim entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Incidentdiscovered Apr 3, 2025

Stated responseNotified federal law enforcement regarding the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov