MalwareProfessional ServicesProfessional ServicesRansomwareData EncryptedRansom DemandedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumActive

The Dovel Group, LLC

bd_d365d6099c730071 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 24, 2021

Filed

Jun 22, 2021

To disclose

8 weeks

Affected

27state residents only

Linked

4 filings

Confidence

67%

Full breach record for The Dovel Group, LLC →

The Dovel Group, LLC disclosed a ransomware attack discovered on April 24, 2021. The incident compromised personal information of contractors, employees, and their dependents, including names, SSNs, driver's licenses, financial account numbers, and medical insurance data. Dovel took systems offline, reset passwords, and offered two years of Equifax credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Apr 24, 2021

Discovered

Jun 22, 2021

Filed

vs. sector median

11 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_30704fafe79873792021-06-22Candidate
Massachusetts State AGbd_50e466f467a35f552021-06-23 · +1dVerified
Indiana State AGbd_8982ca5c534b827f2021-06-23 · +1dVerified

Name: The Dovel Group, LLC
norm: the dovel

Name: The Dovel Group, LLC
norm: the dovel
Industry: Professional Servicesllm

Discovered: Apr 24, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 27state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial

During the incident: Took the impacted systems offline
Began an investigation of the incident
Instituted a company-wide and cross-platform password reset
Adopted additional technical and administrative access controls
Offering you the credit monitoring services
Changes made: Instituted a company-wide and cross-platform password reset
Adopted additional technical and administrative access controls
May implement additional technical changes to our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJun 22 · first

Montana State AGJun 22 · first · this page

Massachusetts State AG+1d

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-17.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2021
Raw hash: 72b45e405baf59fdc5e51a2aa6638d023fc5d3eecffe48b3d3033b919dc3cc8b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityThe Dovel Group, LLC

Victim entityThe Dovel Group, LLC

Incidentdiscovered Apr 24, 2021

Stated responseTook the impacted systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov