HackingDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Cutcliffe Archetto & Santilli
bd_d1134e6e232556ab · schema v1 · pii pii-v1
Full breach record for Cutcliffe Archetto & Santilli →Cutcliffe Archetto & Santilli, a law firm, notified consumers of a cybersecurity incident discovered on May 22, 2025. The incident may have exposed names, addresses, dates of birth, and Social Security Numbers. Approximately 576 Rhode Island residents were impacted. The firm engaged forensic investigators and is offering 12 months of credit monitoring services.
Vermont clock✗ VT AG >45 bday21 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 5 about the same incident.View merged incident
A leak claim by akira about this victim predates this filing by 121 days.View originating leak claim
Linked disclosures
Why this link?Ransomware claims (2)
- bd_79b175df44f5d9c1Leak Siteakirafiled 2025-06-25(111d gap)Verified by operator
- bd_b6119bec1e5dcd5fLeak Siteakirafiled 2025-06-16(121d gap)Verified
Regulatory filings (2) · sorted by filing gap
- bd_24115aa69154ca11Maine State AGfiled 2025-10-15Verified
- bd_b853d9342a141343New Hampshire State AGfiled 2025-10-16(1d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-10-15-cutcliffe-archetto-santilli-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 15, 2025
- Raw hash
- 7726bf04d9059e36ed7707e2103c416985092473fe42606469bb4ccbe51c16c9
Reporting entity
- Name
- Cutcliffe Archetto & Santillinorm: cutcliffe archetto santilli
- Domain
- cutcliffearchetto.com
Victim entity
- Name
- Cutcliffe Archetto & Santillinorm: cutcliffe archetto santilli
- Domain
- cutcliffearchetto.com
Incident
- Discovered
- May 22, 2025
- Materiality determined
- —
- Notification sent
- Oct 15, 2025
- Affected individuals
- 576
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- notify law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 21 weeks(146 days from discovery to filing)
- Compliance flags
- VT AG >45 bdayLeak >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.