HackingProfessional ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Andrew Lundholm CPA

bd_db90b5d792895b18 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2020

Filed

Jul 1, 2020

To disclose

9 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Andrew Lundholm CPA →2 incidents on file

Andrew Lundholm CPA notified clients of unauthorized access to tax filing software between November 24, 2019, and April 29, 2020. The incident, discovered on April 29, 2020, potentially exposed names, addresses, dates of birth, Social Security numbers, and financial account numbers. The firm engaged forensic specialists, reported the breach to the IRS and state regulators, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 157 days

discovery → filing · 9 weeks / 63 days

Nov 24, 2019

Begins

Apr 29, 2020

Discovered

Jul 1, 2020

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Andrew Lundholm CPA
norm: andrew lundholm cpa
Domain: aclcpa.net

Name: Andrew Lundholm CPA
norm: andrew lundholm cpa
Domain: aclcpa.net
Industry: Professional Servicesllm

Discovered: Apr 29, 2020
Breach occurred: Nov 24, 2019 – Apr 29, 2020
Undetected for: 157 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 1, 2020
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Reported the event to the IRSReported the incident to certain state regulators

During the incident: Initiated an investigation into the activity
Working with a computer forensic specialist to determine the full nature and scope of the incident
Reported the event to the IRS
Working with the IRS to reduce the risk of fraudulent tax filings
Reported the incident to certain state regulators
Offering 12 months of complimentary credit monitoring and identity protection services through ID Experts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-191602
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2020
Raw hash: a5d3cb95aec9a7335f58e5e2270a941a7abade02f7d1a39aafb9f53bb1edaded

Reporting entityAndrew Lundholm CPA

Victim entityAndrew Lundholm CPA

Incidentdiscovered Apr 29, 2020

Stated responseInitiated an investigation into the activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov