HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASICMediumContained
GFF&F - Galine, Frye, Fitting & Frangos, LLP
bd_c5b1aa3991c8ca07 · schema v1 · pii pii-v1
Full breach record for GFF&F - Galine, Frye, Fitting & Frangos, LLP →Galine, Frye, Fitting & Frangos, LLP notified the California Attorney General of unauthorized access to its network on October 17, 2025. The firm engaged outside cybersecurity professionals for an investigation, which concluded on December 10, 2025. The incident potentially exposed personal information including names, Social Security numbers, driver's license numbers, bank account information, credit/debit card data, and medical/health insurance information. The firm offered complimentary credit monitoring to affected individuals whose SSNs were impacted.
Leak gap clock⏱ Leak >30d10 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Ransomware claims (1)
- bd_a56f187e1f0eeb88Leak Sitepearfiled 2025-10-14(72d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-616306
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 25, 2025
- Raw hash
- 1eb1bfffa86228bacfe10f0fa0b868f3253c90a10ad7d7c7138fe05f8fe0aee7
Reporting entity
- Name
- GFF&F - Galine, Frye, Fitting & Frangos, LLPnorm: gff f galine frye fitting frangos
- Domain
- dongaline.com
Victim entity
- Name
- GFF&F - Galine, Frye, Fitting & Frangos, LLPnorm: gff f galine frye fitting frangos
- Domain
- dongaline.com
Incident
- Discovered
- Oct 17, 2025
- Materiality determined
- —
- Notification sent
- Dec 15, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTPHIHEALTH_BASIC
- Attack vector
- Unknown
- MITRE ATT&CK
- T1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Filed notification with California Attorney General
Compliance
- Time to disclose
- 10 weeks(69 days from discovery to filing)
- Compliance flags
- Leak >30dCA 60-day OK · 59d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Oct 17, 2025→ Notified: Dec 15, 202559d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.