HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDPIIMediumContained

Orrick, Herrington & Sutcliffe LLP

bd_cf0e5af37d88bd3e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 13, 2023

Filed

Jul 14, 2023

To disclose

18 weeks

Affected

417state residents only

Linked

19 filings

Confidence

66%

Full breach record for Orrick, Herrington & Sutcliffe LLP →9 incidents on file

Orrick, Herrington & Sutcliffe, LLP notified Montana residents of a March 2023 security event where an unauthorized third party gained remote access to client files. The breach impacted personal information including names, addresses, SSNs, and DOBs for individuals enrolled in EyeMed vision benefits plans. Orrick engaged forensic experts, notified law enforcement, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 18 weeks / 123 days

Mar 7, 2023

Begins

Mar 13, 2023

Discovered

Jul 14, 2023

Filed

vs. sector median

1 wks faster

This filing is one of 19 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_0c67b8b72d8d4d752023-07-20 · +6dVerified
Maine State AGbd_d10cdbb5d734268c2023-07-20 · +6dVerified
California State AGbd_cbf3d3e27848f13e2023-07-31 · +17dVerified
California State AGbd_3fe3320cbc86fe1b2023-08-14 · +31dVerified

Show 6 more filings ↓up to 55d gap

Oregon State AGbd_2219323be28eb8d72023-08-18 · +35dVerified
California State AGbd_27c346231339764a2023-08-18 · +35dVerified
Maine State AGbd_cc48c408ae3ef8942023-08-18 · +35dVerified
California State AGbd_13c2d48c6c504f772023-08-21 · +38dVerified
New Hampshire State AGbd_196c4027e22ee5fd2023-08-21 · +38dVerified
South Carolina State AGbd_3e42b9abcb8898e52023-09-07 · +55dVerified

Showing first 10 of 18 linked disclosures.

Name: Orrick, Herrington & Sutcliffe LLP
norm: orrick herrington sutcliffe
Domain: orrick.com

Name: Orrick, Herrington & Sutcliffe LLP
norm: orrick herrington sutcliffe
Domain: orrick.com
Industry: Professional Servicesllm

Discovered: Mar 13, 2023
Breach occurred: Mar 7, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 15, 2023
Affected individuals: 417state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: notified law enforcement
Initial access: valid_credentials

During the incident: Took immediate steps to block the unauthorized access
Launched an investigation of the incident with the support of leading outside cybersecurity experts
Notified law enforcement
Offering two years of complimentary credit monitoring and identity restoration services through Kroll
Deployed additional security measures and tools with the guidance of third-party experts
Changes made: Deployed additional security measures and tools with the guidance of third-party experts to strengthen the ongoing security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(123 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 7 states

View merged incident ↗

Montana State AGJul 14 · first · this page

Indiana State AG+6d

Maine State AG+6d

California State AG+17d

California State AG+31d

Oregon State AG+35d

California State AG+35d

Maine State AG+35d

California State AG+38d

New Hampshire State AG+38d

South Carolina State AG+55d

Pattern: first filing Jul 14 (MT), last Sep 7 (SC) — a 55-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 18 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-431.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2023
Raw hash: 8526f50003e9443a665573fb6242185fe7d4a70b53c6f705c3c1c7d4675c6052

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityOrrick, Herrington & Sutcliffe LLP

Victim entityOrrick, Herrington & Sutcliffe LLP

Incidentdiscovered Mar 13, 2023

Stated responseTook immediate steps to block the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov