MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedDelayed DiscoveryAuthenticationCredentialsFinancial accountHealth (basic)Identity (basic)Government IDPHIHighResolved

Gunster, Yoakley, & Stewart, PA

bd_c61ec90b1a7d4d8d · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 27, 2022

Filed

Dec 4, 2023

To disclose

12 months

Affected

3,014state residents only

Linked

5 filings

Confidence

69%

Full breach record for Gunster, Yoakley, & Stewart, PA →7 incidents on file

Gunster, Yoakley & Stewart, PA, a law firm, reported a supplemental breach notification to the Washington AG regarding a ransomware incident detected on November 27, 2022. Unauthorized access occurred over weeks prior. Approximately 3,014 Washington residents were notified of exposure to PII, SSNs, financial data, and PHI. Notifications began in April 2023. The incident is now resolved.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d12 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 130 days

discovery → filing · 12 months / 372 days

Jul 20, 2022

Begins

Nov 27, 2022

Discovered

Dec 4, 2023

Filed

vs. sector median

+34 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_78b60ff13445b0ec2023-12-04Verified
Montana State AGbd_87b5af26203b089e2023-08-04 · +122dCandidate
New Hampshire State AGbd_e920547675f271aa2023-08-04 · +122dVerified
South Carolina State AGbd_a3b412bcc9b03adc2024-08-01 · +241dVerified

Name: Gunster, Yoakley, & Stewart, PA
norm: gunster yoakley stewart
Domain: gunster.com

Name: Gunster, Yoakley, & Stewart, PA
norm: gunster yoakley stewart
Domain: gunster.com
Industry: Professional Servicesllm

Discovered: Nov 27, 2022
Breach occurred: Jul 20, 2022 – Nov 27, 2022
Undetected for: 130 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 1, 2023
Affected individuals: 3,014state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Data elements: NameDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical informationUsername + password
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcement

During the incident: Took measures to contain the incident and securely restore its network
Conducted a thorough investigation with the assistance of firms
Notified federal law enforcement
Began mailing notifications to individuals in April 2023
Provided substitute notice via nationwide media and a post on Gunster’s website
Offered the residents a complimentary membership to credit monitoring and identity protection services through Kroll
Established a dedicated, toll-free call center to answer questions
Changes made: Implemented additional measures to further strengthen the security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 months(372 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGAug 4 · first

New Hampshire State AGAug 4 · first

California State AG+122d

Washington State AG+122d · this page

South Carolina State AG+363d

Pattern: first filing Aug 4 (MT), last Aug 1 (SC) — a 363-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27178.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 4, 2023
Raw hash: c9c81319ce5c344f259239382cc693d9f3eeb8c0050034c384e0916e074bf53e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityGunster, Yoakley, & Stewart, PA

Victim entityGunster, Yoakley, & Stewart, PA

Incidentdiscovered Nov 27, 2022

Stated responseTook measures to contain the incident and securely restore its network

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com