HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumActive

Calibre CPA Group

bd_c9b305f10e4fa56f · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 10, 2019

To disclose

—

Affected

3state residents only

Linked

6 filings

Confidence

64%

Full breach record for Calibre CPA Group →2 incidents on file

Calibre CPA Group notified the NH Attorney General of unauthorized access to employee email accounts and a server between March 11, 2019, and May 7, 2019. The incident potentially affected 3 New Hampshire residents, exposing names and Social Security numbers. Calibre engaged forensic experts, reset passwords, and offered two years of identity monitoring. The investigation was ongoing at the time of notification.

J jump to incidentP pin to compareR raw source

Incident timeline

Mar 11, 2019

Begins

Sep 10, 2019

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

California State AGbd_469bb67cd6efc5df2019-09-09 · +1dVerified
Massachusetts State AGbd_80543e862f2dd7672019-08-26 · +15dCandidate
Montana State AGbd_fda5cc6a136f7ac92019-08-26 · +15dVerified
HHS OCRbd_b7b0c8592bb421c42019-09-27 · +17dVerified

Show 1 more filing ↓up to 30d gap

Washington State AGbd_66ae17adab8607d62019-10-10 · +30dVerified

Name: Calibre CPA Group
norm: calibre cpa group

Name: Calibre CPA Group
norm: calibre cpa
Industry: Professional Servicesllm

Discovered: —
Breach occurred: Mar 11, 2019 – May 7, 2019
Materiality determined: —
Notification sent: Sep 5, 2019
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralProvided relevant regulatory notices

During the incident: Launched an investigation to determine the full nature and scope of the activity
Engaged computer forensics experts
Resetting passwords for Calibre email accounts
Notified law enforcement
Provided relevant regulatory notices
Providing access to identity and credit monitoring services for two (2) years, through Kroll
Changes made: Implementation of dual factor authentication to gain access to our systems
Scans of emails automatically directed to system drives instead of emails
Additional employee training
Vulnerability studies
Specific cyber-security comprehensive evaluations
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Massachusetts State AGAug 26 · first

Montana State AGAug 26 · first

California State AG+14d

New Hampshire State AG+15d · this page

HHS OCR+32d

Washington State AG+45d

Pattern: first filing Aug 26 (MA), last Oct 10 (WA) — a 45-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/calibre-20190910.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 10, 2019
Raw hash: 6bae08762a0268a0bd2b8c2b5b153f97b45e085769e0480691583ba002e98094

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityCalibre CPA Group

Victim entityCalibre CPA Group

IncidentUnauthorized Access

Stated responseLaunched an investigation to determine the full nature and scope of the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov