Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDFinancial accountHealth (basic)PIIMediumContained

Olinsky & Associates, PLLC

bd_cdcde3b568db9fd7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2025

Filed

Mar 11, 2025

To disclose

6 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Olinsky & Associates, PLLC →

Olinsky & Associates, PLLC disclosed a phishing attack discovered on January 28, 2025, which compromised personal and health information including SSNs and medical records. The firm engaged forensic investigators, notified law enforcement, and provided two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 6 weeks / 42 days

Jan 28, 2025

Discovered

Mar 11, 2025

Filed

vs. sector median

13 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maryland State AGbd_972f5dbdce5657a92025-03-11Verified
New Hampshire State AGbd_afb7511ee47500062025-03-11Verified
Indiana State AGbd_f4c5a4ecf57312492025-03-11Verified
Massachusetts State AGbd_4147b645a8b87dfe2025-03-12 · +1dVerified

Name: Olinsky & Associates, PLLC
norm: olinsky associates

Name: Olinsky & Associates, PLLC
norm: olinsky associates
Industry: Professional Servicesllm

Discovered: Jan 28, 2025
Materiality determined: —
Notification sent: Jan 30, 2025
Affected individuals: 2state-resident count only
Data types: Government IDFinancial accountHealth (basic)PII
Data elements: Social Security numberMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: reported this incident to the policereported this incident to the FBI
Initial access: phishing_link

During the incident: Took steps to secure our systems
Began an investigation with the assistance of a forensic firm
Secured our employees’ e-mail accounts
Restrict the threat actor’s access to our computer system
Reported this incident to the police
Reported this incident to the FBI
Changes made: Implemented several additional security features, including, but not limited to, multi-factor authentication for VPN connections, web filtering, and installation of additional cybersecurity software such as SSL deep inspection and SentinelOne
Secured credit-monitoring services for you... for two years
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Maryland State AGMar 11 · first

New Hampshire State AGMar 11 · first

Indiana State AGMar 11 · first

Montana State AGMar 11 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/03/Consumer-notification-letter-227.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2025
Raw hash: 16cdd1d83e8bce6f8b7ca9158c7834a063f036271e3c6c928db7daff16520ee4

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOlinsky & Associates, PLLC

Victim entityOlinsky & Associates, PLLC

Incidentdiscovered Jan 28, 2025

Stated responseTook steps to secure our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov