HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)LowContained

Quinn Emanuel Urquhart & Sullivan LLP

bd_c67ab365f1c59b80 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 14, 2022

Filed

Jul 21, 2023

To disclose

14 months

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Quinn Emanuel Urquhart & Sullivan LLP →

Quinn Emanuel Urquhart & Sullivan, LLP notified clients of a data breach involving an electronic discovery vendor. An unknown party accessed data in the vendor's data center between May 13-14, 2022. The firm engaged cybersecurity experts and law enforcement. Affected individuals were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered May 14, 2022 → Notified Jul 20, 2023432d ✗ CA 60-day late14 months discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 14 months / 433 days

May 13, 2022

Begins

May 14, 2022

Discovered

Jul 21, 2023

Filed

vs. sector median

+44 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_5f4c536ac05ee94d2023-07-21Candidate
Maine State AGbd_9ba79a48090d5b512023-07-21Verified by operator
Massachusetts State AGbd_a70ba4987d83c9532023-07-21Verified
New Hampshire State AGbd_7164d7453d1eb79c2023-07-20 · +1dVerified

Show 1 more filing ↓up to 1d gap

Indiana State AGbd_80d065dd30fd07e12023-07-20 · +1dVerified

Name: Quinn Emanuel Urquhart & Sullivan LLP
norm: quinn emanuel urquhart sullivan

Name: Quinn Emanuel Urquhart & Sullivan LLP
norm: quinn emanuel urquhart sullivan
Industry: Professional Servicesllm

Discovered: May 14, 2022
Breach occurred: May 13, 2022 – May 14, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2023
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via electronic discovery vendor
Initial access: supply_chain

During the incident: Coordinating with the data center and vendor to better understand the scope and impact of the incident
Engaged third-party cybersecurity experts to remediate, further investigate what happened, and determine the scope of the incident
Reported this incident to law enforcement
Offering access to credit monitoring and identity theft protection services for twenty-four (24) months through Experian at no cost
Changes made: Took steps with its vendors to further protect the privacy and security of the data entrusted to them
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 months(433 days from discovery to filing)
Compliance flags: CA 60-day late · 432d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: May 14, 2022
→ Notified: Jul 20, 2023
432d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: May 14, 2022 → Notified: Jul 20, 2023	432d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGJul 20 · first

Indiana State AGJul 20 · first

Montana State AG+1d

Maine State AG+1d

Massachusetts State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570642
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2023
Raw hash: 1559315ac5c569bcf1d210342716ae7d60f70a23b8544444961cd0724a38d86a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityQuinn Emanuel Urquhart & Sullivan LLP

Victim entityQuinn Emanuel Urquhart & Sullivan LLP

Incidentdiscovered May 14, 2022

Stated responseCoordinating with the data center and vendor to better understand the scope and impact of the incident

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov