HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)Government IDFinancial accountMediumContained

Bomberg, Roach & Hanson, PLLC

bd_de5b684c469e919a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 13, 2016

Filed

Dec 16, 2016

To disclose

13 weeks

Affected

9state residents only

Linked

3 filings

Confidence

66%

Full breach record for Bomberg, Roach & Hanson, PLLC →

Bomberg, Roach & Hanson, PLLC notified clients of a data security incident discovered on September 13, 2016, where an unauthorized individual accessed an electronic file storage system. The incident potentially exposed names, addresses, dates of birth, Social Security numbers, and financial account information. The firm engaged law enforcement, contacted the IRS, and offered 12 months of identity theft protection and credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 weeks / 94 days

Sep 13, 2016

Discovered

Dec 16, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_4aae964087c3b76e2016-12-16Verified
New Hampshire State AGbd_51d9172fafece7ab2016-12-16Verified

Name: Bomberg, Roach & Hanson, PLLC
norm: bomberg roach hanson

Name: Bomberg, Roach & Hanson, PLLC
norm: bomberg roach hanson
Industry: Professional Servicesllm

Discovered: Sep 13, 2016
Materiality determined: —
Notification sent: Dec 12, 2016
Affected individuals: 9state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified law enforcementContacted the IRS
Initial access: valid_credentials

During the incident: Took action to secure our system
Notified law enforcement
Conducted an investigation
Contacted the IRS
Offering identity theft protection services through ID Experts
Offering credit monitoring services
Changes made: Requiring more complex user passwords
Two factor authentication for remote logins
Encrypted email protection
Server monitoring
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 16 · first

New Hampshire State AGDec 16 · first

Montana State AGDec 16 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Bomberg-Roach-Hanson-PLLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 16, 2016
Raw hash: dfa1703366eb56be70c37cea64c9338cd1a28b08b6f48e97a255f514bfaca98a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBomberg, Roach & Hanson, PLLC

Victim entityBomberg, Roach & Hanson, PLLC

Incidentdiscovered Sep 13, 2016

Stated responseTook action to secure our system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov