HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

Tobin, Carberry, O'Malley, Riley & Selinger, P.C.

bd_c2d830c93f63fc35 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 30, 2023

Filed

Jun 14, 2024

To disclose

28 weeks

Affected · nationwide

21,88730 in this filing

Linked

5 filings

Confidence

66%

Full breach record for Tobin, Carberry, O'Malley, Riley & Selinger, P.C. →3 incidents on file

Tobin, Carberry, O'Malley, Riley & Selinger, P.C. reported an external system breach (hacking) on November 30, 2023, discovered on February 13, 2024. The incident affected 21,887 individuals, including 30 Maine residents. Compromised data included names, addresses, DOBs, SSNs, diagnosis/treatment info, and bank account details. Notices were sent June 14, 2024, offering 12 months of credit monitoring via IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 30, 2023 → Filed with AG Jun 14, 2024197d ✗ ME AG >90d28 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 weeks / 197 days

Nov 30, 2023

Begins

Nov 30, 2023

Discovered

Jun 14, 2024

Filed

vs. sector median

+10 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_ac7ec07e9b58cedb2024-06-14Candidate
New Hampshire State AGbd_073dcd7dd37c40e72024-06-21 · +7dVerified
Maine State AGbd_4c7a32e9c31eca5c2024-08-30 · +77dVerified
New Hampshire State AGbd_8b56fa5710d3e74a2024-09-09 · +87dVerified

Name: Tobin, Carberry, O'Malley, Riley & Selinger, P.C.
norm: tobin carberry o malley riley selinger

Name: Tobin, Carberry, O'Malley, Riley & Selinger, P.C.
norm: tobin carberry o malley riley selinger
Industry: Professional Servicesllm

Discovered: Nov 30, 2023
Breach occurred: Nov 30, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2024
Affected individuals: 21,887state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1119 Automated Collection
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Implemented incident response protocols
Engaged independent computer forensic experts
Changed all passwords
Deployed an advanced endpoint and detection monitoring software
Arranged for credit monitoring and identity protection services
Changes made: Deployed an advanced endpoint and detection monitoring software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: ME AG >90d · 197dME resident >60d · 197d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 30, 2023
→ Filed with AG: Jun 14, 2024
197d 90 days ME AG >90d
Maine
Discovered: Nov 30, 2023
→ Notified: Jun 14, 2024
197d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 30, 2023 → Filed with AG: Jun 14, 2024	197d	90 days	ME AG >90d
Maine	Discovered: Nov 30, 2023 → Notified: Jun 14, 2024	197d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Montana State AGJun 14 · first

Maine State AGJun 14 · first · this page

New Hampshire State AG+7d

Maine State AG+77d

New Hampshire State AG+87d

Pattern: first filing Jun 14 (MT), last Sep 9 (NH) — a 87-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/287a8a5e-126d-4939-9ba0-8dd809dbc4f5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2024
Raw hash: 34304e41f051ccb6b04d9e39a27ff3133abb6e754d8fa984bcb8477a35c24c30

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTobin, Carberry, O'Malley, Riley & Selinger, P.C.

Victim entityTobin, Carberry, O'Malley, Riley & Selinger, P.C.

Incidentdiscovered Nov 30, 2023

Stated responseImplemented incident response protocols

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov