HackingIdentity (basic)Government IDHealth (basic)MediumContained

Zalkin Law Firm, P.C.

bd_e516fa6edf184c3e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 6, 2023

Filed

Sep 14, 2023

To disclose

8 days

Affected

6state residents only

Linked

5 records

Confidence

66%

Full breach record for Zalkin Law Firm, P.C. →

The Zalkin Law Firm, P.C. notified Montana residents of a data security incident where an unauthorized third party accessed its network. Exposed data included names, addresses, driver's license numbers, SSNs, and medical information. The firm secured its network, engaged forensic specialists, notified law enforcement, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d8 days discovery → filing

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · 8 days

Sep 6, 2023

Discovered

Sep 14, 2023

Filed

This filing is one of 5 records about the same incident.View merged incident

A leak claim by alphv about this victim was first seen 50 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitealphvbd_2f0d6456044400412023-04-08 · +159dVerified by operator

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_3be90daee49278d22023-09-14Verified by operator
Indiana State AGbd_039fe986c60434ae2023-09-06 · +8dVerified by operator
Massachusetts State AGbd_c793d5e5644307ef2023-09-25 · +11dVerified by operator

Name: Zalkin Law Firm, P.C.
norm: zalkin law firm
Domain: zalkin.com

Name: Zalkin Law Firm, P.C.
norm: zalkin law firm
Domain: zalkin.com

Discovered: Sep 6, 2023
Materiality determined: —
Notification sent: Sep 6, 2023
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Reported matter to law enforcement
Initial access: valid_credentials

During the incident: Initiated incident response plan
Secured network and data
Engaged third-party forensic specialists
Reported matter to law enforcement
Provided credit monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 days(8 days from discovery to filing)
Compliance flags: Leak >30d
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 6 · first

Maine State AG+8d

Montana State AG+8d · this page

Massachusetts State AG+19d

Pattern: first filing Sep 6 (IN), last Sep 25 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-675.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2023
Raw hash: 57830072a51a3e9f9f7c94171e3898e7496f6232b14c231aece88fa9c810d046

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityZalkin Law Firm, P.C.

Victim entityZalkin Law Firm, P.C.

Incidentdiscovered Sep 6, 2023

Stated responseInitiated incident response plan

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancedojmt.gov