HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumActive

Vanni & Humphrey CPAs

bd_c98426798958624a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2025

Filed

Apr 15, 2025

To disclose

27 days

Affected

Not disclosed

Confidence

64%

Full breach record for Vanni & Humphrey CPAs →

Vanni & Humphrey detected unauthorized access to its SmartVault client portal on March 19, 2025. An unauthorized third party downloaded documents containing names, addresses, SSNs, driver's license numbers, and financial account information. The firm engaged forensic investigators and secured the portal. Investigation is ongoing. Affected individuals are offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 19, 2025 → Notified Apr 15, 202527d ✓ CA 60-day OK27 days discovery → filing

Incident timeline

discovery → filing · 27 days

Mar 19, 2025

Begins

Mar 19, 2025

Discovered

Apr 15, 2025

Filed

vs. sector median

16 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Vanni & Humphrey CPAs
norm: vanni humphrey cpas
Domain: vannihumphrey.com

Name: Vanni & Humphrey CPAs
norm: vanni humphrey cpas
Domain: vannihumphrey.com
Industry: Professional Servicesllm

Discovered: Mar 19, 2025
Breach occurred: Mar 19, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 15, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: valid_credentials

During the incident: Moved quickly to secure the portal
Launched a thorough investigation
Engaged independent IT security and forensic investigators
Engaged external cybersecurity experts
Changes made: Implementing additional safeguards and enhanced security measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: CA 60-day OK · 27d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 19, 2025
→ Notified: Apr 15, 2025
27d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 19, 2025 → Notified: Apr 15, 2025	27d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-601443
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 15, 2025
Raw hash: ffb5161bc5e41d6408e938fdfad327e6be32a8454a04d46f60bcb302e3358c5e

Reporting entityVanni & Humphrey CPAs

Victim entityVanni & Humphrey CPAs

Incidentdiscovered Mar 19, 2025

Stated responseMoved quickly to secure the portal

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov