HackingProfessional ServicesProfessional ServicesStolen CredentialsBECTargetedData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountEmploymentMediumContained

Wheeler & Egger, CPAs

bd_d47a9b3a7130cd50 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 15, 2016

Filed

Sep 11, 2016

To disclose

27 days

Affected

3state residents only

Linked

4 filings

Confidence

65%

Full breach record for Wheeler & Egger, CPAs →

Wheeler & Egger, CPAs, LLC reported a data breach where attackers hacked its system between Aug 3-9, 2016, to fraudulently file 46 client tax returns. Discovered Aug 15, 2016. 3 NH residents affected. Data included SSNs, bank info, and W-2s. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 12 days

discovery → filing · 27 days

Aug 3, 2016

Begins

Aug 15, 2016

Discovered

Sep 11, 2016

Filed

vs. sector median

15 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_8e1c0502d77c41512016-09-11Verified
South Carolina State AGbd_7ed17255263123b82016-09-12 · +1dCandidate
Montana State AGbd_1a0b44c384a5de162016-09-13 · +2dVerified

Name: Murphy Pearson Bradley & Feeney
norm: murphy pearson bradley feeney
Domain: mpbf.com

Name: Wheeler & Egger, CPAs
norm: wheeler egger cpas
Industry: Professional Servicesllm

Discovered: Aug 15, 2016
Breach occurred: Aug 3, 2016 – Aug 9, 2016
Undetected for: 12 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 13, 2016
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountEmployment
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified IRSNotified FTBNotified FBINotified US Secret ServiceNotified consumer reporting agenciesFiled police report with FBI IC3
Initial access: valid_credentials

During the incident: Filed notice of their firm’s cyber intrusion with the IRS, FTB, FBI, the US Secret Service, all three consumer reporting agencies
Filed a police report with the FBI’s online Internet Crime Complaint Center (IC3)
Actively working with the IRS and FTB to protect their clients and to assist the agencies’ investigations
Provided a dedicated call center that potentially affected individuals can call with questions regarding the incident
Providing one year of credit monitoring services provided through AllClear ID
Changes made: Providing one year of credit monitoring services provided through AllClear ID
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGSep 11 · first

New Hampshire State AGSep 11 · first · this page

South Carolina State AG+1d

Montana State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/wheeler-egger-20160911.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2016
Raw hash: 55fa584f501296f33b5ddbce2bb88d6f8839ebe1316f6b9caeaa1f066bb12255

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMurphy Pearson Bradley & Feeney

Victim entityWheeler & Egger, CPAs

Incidentdiscovered Aug 15, 2016

Stated responseFiled notice of their firm’s cyber intrusion with the IRS, FTB, FBI, the US Secret Service, all three consumer reporting agencies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov