HackingProfessional ServicesProfessional ServicesSupply Chain (3P Vendor)Data ExfiltratedGovernment IDPIIHighContained

Perkins & Co.

bd_d88b7d43b1ec8b32 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 3, 2020

Filed

Mar 26, 2021

To disclose

16 weeks

Affected · nationwide

2,6422 in this filing

Linked

24 filings

Confidence

64%

Full breach record for Perkins & Co. →9 incidents on file

Perkins & Co., an accounting firm based in Oregon, reported a data breach involving a third-party service provider. The incident occurred between November 8, 2020, and December 3, 2020, affecting 2,642 individuals, including 2 Maine residents. The breach compromised names and Social Security Numbers. Perkins & Co. notified affected individuals in writing on March 26, 2021, and provided 24 months of credit monitoring and identity restoration services through IDX.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Dec 3, 2020 → Filed with AG Mar 26, 2021113d ✗ ME AG >90d16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 25 days

discovery → filing · 16 weeks / 113 days

Nov 8, 2020

Begins

Dec 3, 2020

Discovered

Mar 26, 2021

Filed

vs. sector median

3 wks faster

This filing is one of 24 about the same incident.View merged incident

Part of Netgain Networks supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_ba5d30aabab3a1412022-05-26 · +426dVerified by operator
Maine State AGbd_610cc7cd82ffe1fc2022-05-27 · +427dVerified by operator
Maine State AGbd_b09bf7a0d1084a492022-05-27 · +427dVerified by operator
Delaware State AGbd_ea38731c50620c8e2022-05-27 · +427dVerified by operator

Show 6 more filings ↓up to 560d gap

Oregon State AGbd_f2d5e0dbc45e8b312022-05-27 · +427dVerified by operator
New Hampshire State AGbd_74b4a2c65ecffaf02022-06-03 · +434dVerified by operator
Maine State AGbd_a5e34a8d20612f032022-08-12 · +504dVerified by operator
New Hampshire State AGbd_93170f27b6189a1f2022-08-15 · +507dVerified by operator
Maine State AGbd_1082f5dc91ef0c192022-10-03 · +556dVerified by operator
New Hampshire State AGbd_e7f5945f3e1b9bfe2022-10-07 · +560dVerified by operator

Showing first 10 of 23 linked disclosures.

Name: Perkins & Co.
norm: perkins
Domain: perkinsaccounting.com

Name: Perkins & Co.
norm: perkins
Domain: perkinsaccounting.com
Industry: Professional Servicesllm

Discovered: Dec 3, 2020
Breach occurred: Nov 8, 2020 – Dec 3, 2020
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 26, 2021
Affected individuals: 2,642state + nationwide
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: supply_chain

During the incident: Sent written notification to affected individuals
Offered 24 months of credit monitoring and identity restoration services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: ME AG >90d · 113d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Dec 3, 2020
→ Filed with AG: Mar 26, 2021
113d 90 days ME AG >90d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Dec 3, 2020 → Filed with AG: Mar 26, 2021	113d	90 days	ME AG >90d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

Maine State AGMar 26 · first · this page

Delaware State AG+426d

Maine State AG+427d

Delaware State AG+427d

Oregon State AG+427d

New Hampshire State AG+434d

Maine State AG+504d

New Hampshire State AG+507d

Maine State AG+556d

New Hampshire State AG+560d

Pattern: first filing Mar 26 (ME), last Oct 7 (NH) — a 560-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 23 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/1319ce35-6f2e-4f61-a6a8-28df2d63c926.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2021
Raw hash: debefbefc24223a922f0b05d163369337fa2d38ecdcc696b8b8c4c29301f3f81

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPerkins & Co.

Victim entityPerkins & Co.

Incidentdiscovered Dec 3, 2020

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov