MalwareProfessional ServicesProfessional ServicesRansomwareVulnerability ExploitRansom DemandedRansom PaidData EncryptedTargetedGovernment IDFinancial accountIdentity (basic)PIIHighContained

Medaglia & Murphy, Inc.

bd_e6b624e3b6541fb9 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 29, 2021

Filed

Mar 21, 2022

To disclose

12 weeks

Affected

3,244state residents only

Linked

3 filings

Confidence

66%

Medaglia & Murphy, Inc. reported a data security incident discovered on December 29, 2021, where a third party gained unauthorized remote access to its network. The incident affected 3,244 New Hampshire residents (2,807 adults and 437 minors). The attacker demanded a ransom, which was paid after negotiations facilitated by the USSS. Data accessed likely included SSNs, financial account numbers, and tax returns. Affected individuals received notification on March 16, 2022, and were offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 82 days

Dec 29, 2021

Discovered

Mar 21, 2022

Filed

vs. sector median

7 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Maine State AGbd_fe4cfd92dff0087c2022-03-21Candidate
Massachusetts State AGbd_ff028f1a6e1a2f132022-03-18 · +3dVerified

Name: MCLANE MIDDLETON, PROFESSIONAL ASSOCIATION
norm: mclane middleton professional

Name: Medaglia & Murphy, Inc.
norm: medaglia & murphy
Domain: medagliaco.com
Industry: Professional Servicesllm

Discovered: Dec 29, 2021
Materiality determined: —
Notification sent: Mar 16, 2022
Affected individuals: 3,244state-resident count only
Data types: Government IDFinancial accountIdentity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified the cyber security division of the Internal Revenue Service (IRS)Worked with the United States Secret Service (USSS)
Initial access: exploit_public_facing

During the incident: Contacted its managed information technology service provider (MSP)
Disabled the Internet connection to the network
Deactivated servers and computers on the network
MSP removed all potential malware from Medaglia & Murphy’s servers and computers
Rapidly rebuilt the network
Retained a cyber security attorney and a forensic expert
Initiated the process to notify the cyber security division of the Internal Revenue Service (IRS)
Supplied the IRS with the information necessary to activate the IRS’s advance fraud detection and prevention system, called Return Integrity Compliance Services (RICS)
Engaged with the third parties to assess their reliability and negotiate certain assurances
Communicated with and relied on federal law enforcement at the United States Secret Service (USSS)
Paid the ransom
Forensic expert monitored the dark web
Retained Epiq to provide notification letters, call center services, and credit and identity monitoring and restoration protection
Changes made: Working with cyber security attorney and technology providers to conduct a comprehensive assessment of technological, physical, and administrative processes to identify other potential opportunities to enhance cyber security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMar 18 · first

Maine State AG+3d

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/medaglia-murphy-20220321.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2022
Raw hash: 74ff8f7811c221ab82786a9b0b820242dc91388540f97520d55732a5f82ed12a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMCLANE MIDDLETON, PROFESSIONAL ASSOCIATION

Victim entityMedaglia & Murphy, Inc.

Incidentdiscovered Dec 29, 2021

Stated responseContacted its managed information technology service provider (MSP)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov