Social EngineeringProfessional ServicesCustomer Data InvolvedData ExfiltratedPIIIdentity (basic)MediumContained

PILLSBURY WINTHROP SHAW PITTMAN LLP

bd_c6f6eef2131011f3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 23, 2025

Filed

Nov 6, 2025

To disclose

28 weeks

Affected

Not disclosed

Linked

10 filings

Confidence

64%

Full breach record for PILLSBURY WINTHROP SHAW PITTMAN LLP →3 incidents on file

Pillsbury Winthrop Shaw Pitman LLP notified individuals of a security incident in late April 2025 where an unauthorized actor downloaded firm documents following a social engineering attack. The breach exposed personal information including names, Social Security numbers, and financial account numbers. The firm engaged forensic investigators, notified law enforcement, and is offering 24 months of credit monitoring through Equifax.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 22 days

discovery → filing · 28 weeks / 197 days

Apr 1, 2025

Begins

Apr 23, 2025

Discovered

Nov 6, 2025

Filed

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

South Carolina State AGbd_0ba5f2f7e42e487f2025-11-06Verified
New Hampshire State AGbd_4d95cd9f800da5f42025-11-06Verified
Washington State AGbd_5cd3ec15e94a68df2025-11-06Verified
Nebraska State AGbd_8e31e65cc116ce642025-11-06Verified

Show 5 more filings ↓up to 1d gap

Montana State AGbd_b215afd6546944fc2025-11-06Candidate
Iowa State AGbd_b9c1fcb0d2856ca22025-11-06Verified
Indiana State AGbd_dc43924c9e59e1212025-11-06Verified
Massachusetts State AGbd_eaf26ad5c60188452025-11-06Verified
Texas State AGbd_58a008bb40c21d442025-11-07 · +1dVerified

Name: PILLSBURY WINTHROP SHAW PITTMAN LLP
norm: pillsbury winthrop shaw pittman

Name: PILLSBURY WINTHROP SHAW PITTMAN LLP
norm: pillsbury winthrop shaw pittman

Discovered: Apr 23, 2025
Breach occurred: Apr 1, 2025 – Apr 30, 2025
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 23, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement
Initial access: phishing_link

During the incident: Began an investigation with assistance from a third-party forensic firm
Notified law enforcement
Add further protections to harden our systems
Offering you a complimentary 24-month membership for credit monitoring and identity theft protection services through Equifax
Deploy additional safeguards onto our systems
Reinforcing our security practices
Actively reviewing our systems to enhance security monitoring and controls
Changes made: Deploy additional safeguards onto our systems
Reinforcing our security practices
Actively reviewing our systems to enhance security monitoring and controls
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(197 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

South Carolina State AGNov 6 · first

New Hampshire State AGNov 6 · first

Washington State AGNov 6 · first

Nebraska State AGNov 6 · first

Montana State AGNov 6 · first

Iowa State AGNov 6 · first

Indiana State AGNov 6 · first

Massachusetts State AGNov 6 · first

Delaware State AGNov 6 · first · this page

Texas State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2026/01/Pillsbury_Sample-Individual-Notice-11-06-25__.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 6, 2025
Raw hash: 7f5072dd42be0b832dc863267616d13886724a9104ad364582c23e818175e5e6

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityPILLSBURY WINTHROP SHAW PITTMAN LLP

Victim entityPILLSBURY WINTHROP SHAW PITTMAN LLP

Incidentdiscovered Apr 23, 2025

Stated responseBegan an investigation with assistance from a third-party forensic firm

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov