HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedTargetedIdentity (basic)MinorMediumContained

Troy A. Washko, CPA, P.C.

bd_e0596a045fbf7cb9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 1, 2020

Filed

Dec 24, 2020

To disclose

29 weeks

Affected

1state residents only

Linked

5 filings

Confidence

66%

Full breach record for Troy A. Washko, CPA, P.C. →2 incidents on file

Troy A. Washko, CPA, P.C. notified individuals of unauthorized access to employee email, Dropbox, and Teams accounts on June 24, 2020. The breach exposed names and other personal information of clients and minor children. The firm engaged forensic investigators, reset passwords, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 24, 2020

Begins

Dec 24, 2020

Filed

vs. sector median

+12 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_1953e122019e1b1f2020-12-24Verified
Indiana State AGbd_66d7fc24b6a64d8b2020-12-24Verified
Maine State AGbd_6bb497b2fb64b09a2020-12-24Candidate
New Hampshire State AGbd_4579840c7b8312c92021-01-06 · +13dVerified

Name: Troy A. Washko, CPA, P.C.
norm: troy a washko cpa

Name: Troy A. Washko, CPA, P.C.
norm: troy a washko cpa
Industry: Professional Servicesllm

Discovered: Jun 1, 2020
Breach occurred: Jun 24, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Minor
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: reporting this incident to necessary state regulators
Initial access: valid_credentials

During the incident: Commenced an investigation, working with third-party IT and forensic investigators
Immediately reset relevant passwords on June 24, 2020
Undertook a comprehensive review of the contents of the three accounts
Reporting this incident to necessary state regulators
Providing you with access to <<CM Length>> months of identity protection service through TransUnion at no cost to you
Changes made: Reviewing and enhancing existing policies and procedures
Deployment of multi-factor authentication for our accounts
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 weeks(206 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGDec 24 · first

Indiana State AGDec 24 · first

Maine State AGDec 24 · first

Montana State AGDec 24 · first · this page

New Hampshire State AG+13d

Pattern: first filing Dec 24 (MA), last Jan 6 (NH) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/troySamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 24, 2020
Raw hash: ebc14a8954292ca708072fb07d5be7166580230794b1c4b9a8569a676e0099a5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityTroy A. Washko, CPA, P.C.

Victim entityTroy A. Washko, CPA, P.C.

Incidentdiscovered Jun 1, 2020

Stated responseCommenced an investigation, working with third-party IT and forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov