HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedRansom DemandedIdentity (basic)Government IDFinancial accountMediumContained

Morgan & Associates

bd_cfb6b7e3366f3cc5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 18, 2024

Filed

Dec 2, 2024

To disclose

11 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

67%

Full breach record for Morgan & Associates →

Morgan & Associates CPAs, PC disclosed a data breach affecting client tax files. A business partner's account was compromised, granting unauthorized access to tax preparation software from Jan 7 to Sep 18, 2024. The attacker accessed personal information and attempted to file fraudulent tax returns. Morgan & Associates engaged forensic professionals, enhanced MFA, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 255 days

discovery → filing · 11 weeks / 75 days

Jan 7, 2024

Begins

Sep 18, 2024

Discovered

Dec 2, 2024

Filed

vs. sector median

9 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_fe06b3e6a4c43e3b2024-12-02Verified

Name: Morgan & Associates
norm: morgan associates
Domain: morganscpas.com

Name: Morgan & Associates
norm: morgan associates
Domain: morganscpas.com
Industry: Professional Servicesllm

Discovered: Sep 18, 2024
Breach occurred: Jan 7, 2024 – Sep 18, 2024
Undetected for: 255 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 2, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: notifying the Internal Revenue Service and state tax authoritiesreported this Incident to relevant government agencies
Initial access: valid_credentials

During the incident: Changed passwords
Notifying the Internal Revenue Service and state tax authorities
Engaging data security and privacy professionals to assist
Added technical security protections on top of our existing protections
Enhancing the implementation of multifactor authentication
Adding security controls to provide for increased monitoring over our environment
Analyzing the information involved to confirm the identities of potentially affected individuals
Reported this Incident to relevant government agencies
Offering complimentary access to Equifax Credit Watch Gold
Changes made: Enhancing the implementation of multifactor authentication
Adding security controls to provide for increased monitoring over our environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGDec 2 · first

Vermont State AGDec 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-12-02-morgan-associates-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 2, 2024
Raw hash: 80f4ab784273b86650585d195205274b54337d80a4ea13e13010cfd63932c20b

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMorgan & Associates

Victim entityMorgan & Associates

Incidentdiscovered Sep 18, 2024

Stated responseChanged passwords

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov