MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedTargetedFinancial accountIdentity (basic)Government IDPHIHealth (basic)HighContained

Schauermann Thayer Law Firm

bd_c50ee7593c867f5c · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 15, 2024

Filed

Apr 28, 2025

To disclose

32 weeks

Affected

2,021state residents only

Linked

3 filings

Confidence

68%

Full breach record for Schauermann Thayer Law Firm →

Schauermann Thayer Law Firm notified Washington AG of a ransomware incident discovered on September 15, 2024. The breach affected 2,021 Washington residents, exposing names and financial account numbers. The firm engaged forensic specialists, secured its network, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d32 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 32 days

discovery → filing · 32 weeks / 225 days

Aug 14, 2024

Begins

Sep 15, 2024

Discovered

Apr 23, 2025

Scope determined

Apr 28, 2025

Filed

vs. sector median

+15 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_d4ae72bbf079e3ec2025-04-28Verified by operator
New Hampshire State AGbd_71f7ebccd37046b72025-04-23 · +5dVerified

Name: Schauermann Thayer Law Firm
norm: schauermann thayer law firm
Industry: Legal

Name: Schauermann Thayer Law Firm
norm: schauermann thayer law firm
Industry: Legal
Industry: Professional Servicesllm

Discovered: Sep 15, 2024
Breach occurred: Aug 14, 2024 – Sep 15, 2024
Undetected for: 32 daysoccurrence → discovery
Materiality determined: Apr 23, 2025
Notification sent: Apr 23, 2025
Affected individuals: 2,021state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthMilitary ID numberPassport numberHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: valid_credentials

During the incident: Secured our network
Engaged a third-party team of forensic specialists to investigate the full nature and scope of the incident
Arranged for you to enroll, at no cost to you, in an online credit monitoring service through IDX for 12 months
Changes made: Secured our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(225 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 23 · first

Oregon State AG+5d

Washington State AG+5d · this page

Pattern: first filing Apr 23 (NH), last Apr 28 (WA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA33137.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2025
Raw hash: 510a46490d977ef70ad228b78785b66a0561c9a24bbbfdfa009c3291c7146273

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySchauermann Thayer Law Firm

Victim entitySchauermann Thayer Law Firm

Incidentdiscovered Sep 15, 2024

Stated responseSecured our network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com