HackingProfessional ServicesProfessional ServicesDelayed DiscoveryIdentity (basic)Government IDMediumContained

Legal Aid of Western Missouri

bd_d479402c887a49f2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 30, 2024

Filed

Feb 25, 2025

To disclose

43 weeks

Affected

4state residents only

Linked

3 filings

Confidence

65%

Full breach record for Legal Aid of Western Missouri →

Legal Aid of Western Missouri notified Maryland AG of unauthorized network access between Dec 2023 and May 2024, discovered April 2024. 4 Maryland residents affected; data included names, SSNs, passports, and TINs. Legal Aid engaged third-party specialists, secured network, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maryland clock✗ MD AG >90d43 weeks discovery → filing

Incident timeline

undetected · 151 days

discovery → filing · 43 weeks / 301 days

Dec 1, 2023

Begins

Apr 30, 2024

Discovered

Feb 25, 2025

Filed

vs. sector median

+24 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_23271b40e1245f1a2025-02-25Candidate
Nebraska State AGbd_c33f1090be85cb892025-02-25Verified

Name: Cipriani
norm: cipriani
Domain: cipriani.com

Name: Legal Aid of Western Missouri
norm: legal aid of western missouri
Industry: Professional Servicesllm

Discovered: Apr 30, 2024
Breach occurred: Dec 1, 2023 – May 9, 2024
Undetected for: 151 daysoccurrence → discovery
Materiality determined: Feb 25, 2025
Notification sent: Feb 25, 2025
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Engaged third-party specialists to assist with determining the nature and scope of the event
Took steps to secure its network environment
Undertook a thorough investigation
Began providing notice to the potentially impacted individuals via U.S. mail
Changes made: Implemented additional technical safeguards to further enhance the security of information in its possession
Offering 12 months of complimentary credit monitoring and identity protection services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 43 weeks(301 days from discovery to filing)
Compliance flags: MD AG >90d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGFeb 25 · first

Nebraska State AGFeb 25 · first

Maryland State AGFeb 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376422.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2025
Raw hash: 22d1b91f1029b34c83abf24beb7f2455a6db3817b9833a4369d97d490d66d2c0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCipriani

Victim entityLegal Aid of Western Missouri

Incidentdiscovered Apr 30, 2024

Stated responseEngaged third-party specialists to assist with determining the nature and scope of the event

ComplianceMD AG >90d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov