HackingData ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Legacy Professionals, LLP
bd_e36cc97a1f40851d · schema v1 · pii pii-v1
Full breach record for Legacy Professionals, LLP →Legacy Professionals, LLP notified the Maryland AG of a data event affecting 477 residents. Unauthorized access occurred in April 2024, resulting in the exfiltration of names, SSNs, and financial account data. Legacy engaged forensic investigators, notified law enforcement, and is offering two years of credit monitoring.
Maryland clock✗ MD AG >90d48 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
A leak claim by lockbit_3 about this victim predates this filing by 301 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_2b2c9c813c33d341New Hampshire State AGfiled 2025-02-28Verified
- bd_668ab37ff5d363e4California State AGfiled 2025-02-28Candidate
Source provenance
- Source URL
- https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376441.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 28, 2025
- Raw hash
- 92768f248715334acc4313c2dc226cd43d82e9760efb396ae146fc6b9422c117
Reporting entity
- Name
- Mullen Coughlin LLCnorm: mullen coughlin
Victim entity
- Name
- Legacy Professionals, LLPnorm: legacy professionals
- Domain
- legacycpas.com
Incident
- Discovered
- Apr 1, 2024
- Materiality determined
- —
- Notification sent
- Feb 27, 2025
- Affected individuals
- 477
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified federal law enforcementProviding written notice to relevant state and federal regulatorsProviding written notice to the three major credit reporting agencies
Compliance
- Time to disclose
- 48 weeks(333 days from discovery to filing)
- Compliance flags
- MD AG >90dLeak >180d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.