HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)CredentialsMediumContained

Primmer Piper Eggleston & Cramer PC

bd_e012e4863253166b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2021

Filed

Nov 23, 2022

To disclose

13 months

Affected

265state residents only

Linked

4 filings

Confidence

66%

Full breach record for Primmer Piper Eggleston & Cramer PC →2 incidents on file

Primmer, Piper, Eggleston, & Cramer reported an unauthorized third-party access to its network in November 2021, resulting in data exfiltration to a foreign hosting site. The incident affected 265 New Hampshire residents, exposing PII including SSNs, driver's licenses, financial account numbers, medical info, and credentials. Primmer engaged forensic investigators, locked access within two hours, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 13 months / 387 days

Nov 1, 2021

Discovered

Apr 14, 2022

Scope determined

Nov 23, 2022

Filed

vs. sector median

+38 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_5a3849e6539560902022-07-27 · +119dCandidate
Massachusetts State AGbd_8cec6aff19d896a22022-07-27 · +119dVerified
Maine State AGbd_d39da0ff6c51c9ec2022-07-27 · +119dVerified by operator

Name: Primmer Piper Eggleston & Cramer PC
norm: primmer piper eggleston cramer

Name: Primmer Piper Eggleston & Cramer PC
norm: primmer piper eggleston cramer
Industry: Professional Servicesllm

Discovered: Nov 1, 2021
Materiality determined: Apr 14, 2022
Notification sent: Jul 25, 2022
Affected individuals: 265state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified the Attorney General of the State of New Hampshire
Initial access: exploit_public_facing

During the incident: Engaged an IT security firm to assist in its investigation
Worked with the site and law enforcement to lock access to the data within two hours of it being uploaded
Had the site destroy the copy it was hosting
Conducted an investigation into how the incident occurred
Provided identity protection and credit monitoring services through Experian
Changes made: Continues to implement appropriate safeguards to protect personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 months(387 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJul 27 · first

Massachusetts State AGJul 27 · first

Maine State AGJul 27 · first

New Hampshire State AG+119d · this page

Pattern: first filing Jul 27 (MT), last Nov 23 (NH) — a 119-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/primmer-piper-eggleston-cramer-20221123.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 23, 2022
Raw hash: 8bb14e2e0326e0776e35939d4153f5d6ebac30bc87047aac27f5a2a032509bc8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPrimmer Piper Eggleston & Cramer PC

Victim entityPrimmer Piper Eggleston & Cramer PC

Incidentdiscovered Nov 1, 2021

Stated responseEngaged an IT security firm to assist in its investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov