HackingProfessional ServicesProfessional ServicesTargetedData ExfiltratedIdentity (basic)Government IDMediumContained

McElroy, Deutsch, Mulvaney & Carpenter LLP

bd_df428c93170c98cf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2025

Filed

Mar 12, 2026

To disclose

49 weeks

Affected

5state residents only

Linked

6 filings

Confidence

66%

Full breach record for McElroy, Deutsch, Mulvaney & Carpenter LLP →

McElroy, Deutsch, Mulvaney & Carpenter LLP (MDMC) reported a supplemental data breach affecting 5 Maine residents. Unauthorized actors accessed data containing names and Social Security numbers between March 28 and April 1, 2025. MDMC discovered the incident on April 3, 2025, and notified affected individuals on March 12, 2026, offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 3, 2025 → Filed with AG Mar 12, 2026343d ✗ ME AG >90d49 weeks discovery → filing

Incident timeline

undetected · 6 days

discovery → filing · 49 weeks / 343 days

Mar 28, 2025

Begins

Apr 3, 2025

Discovered

Mar 12, 2026

Filed

vs. sector median

+30 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_03b000a29a602b0c2026-03-12Candidate
Indiana State AGbd_698f1a0d029620162025-12-19 · +83dVerified
Nebraska State AGbd_6da1ae289ac345962025-12-19 · +83dVerified
New Hampshire State AGbd_bd3f74df05a359e32025-12-19 · +83dVerified

Show 1 more filing ↓up to 83d gap

Maine State AGbd_efd18d3b3c3e05362025-12-19 · +83dCandidate

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Legal Services

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Legal Services
Industry: Professional Servicesllm

Discovered: Apr 3, 2025
Breach occurred: Mar 28, 2025 – Apr 1, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 12, 2026
Affected individuals: 5state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified relevant regulators, as required
Initial access: exploit_public_facing

During the incident: Moved quickly to respond and investigate the suspicious activity
Secured our network
Notified federal law enforcement
Providing access to credit monitoring services for twelve (12) months, through Epiq
Changes made: Reviewing our policies and procedures to reduce the likelihood of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(343 days from discovery to filing)
Compliance flags: ME AG >90d · 343dME resident >180d · 343d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 3, 2025
→ Filed with AG: Mar 12, 2026
343d 90 days ME AG >90d
Maine
Discovered: Apr 3, 2025
→ Notified: Mar 12, 2026
343d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 3, 2025 → Filed with AG: Mar 12, 2026	343d	90 days	ME AG >90d
Maine	Discovered: Apr 3, 2025 → Notified: Mar 12, 2026	343d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Indiana State AGDec 19 · first

Nebraska State AGDec 19 · first

New Hampshire State AGDec 19 · first

Maine State AGDec 19 · first

New Hampshire State AG+83d

Maine State AG+83d · this page

Pattern: first filing Dec 19 (IN), last Mar 12 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/ec74db3e-22c6-45a0-a804-957388afadf5.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 12, 2026
Raw hash: cc7d7b08adc27c9bf2838515f4cfa915ac770fd2fac27d1abfb161f9a06741b9

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Victim entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Incidentdiscovered Apr 3, 2025

Stated responseMoved quickly to respond and investigate the suspicious activity

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov