HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumContained

Castaglia, LLP

bd_e8afd09a3424c18c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 26, 2026

Filed

Apr 28, 2026

To disclose

—

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Castaglia, LLP →

Castiglia, LLP, a law firm, disclosed a cybersecurity incident affecting two Nebraska residents. Unauthorized access occurred between Feb 28 and Mar 8, 2026. The firm determined on Mar 26 that files contained names, SSNs, driver's licenses, and financial account numbers. Notifications were mailed on Apr 28, 2026, offering one year of Kroll credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 26 days

Feb 28, 2026

Begins

Mar 26, 2026

Discovered

Apr 28, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4d1d7f895e14bb102026-04-28Candidate
Maine State AGbd_54af497dfcbf72cb2026-04-28Verified
Vermont State AGbd_9f6d12a16e64ce782026-04-28Verified

Name: Castaglia, LLP
norm: castaglia

Name: Castaglia, LLP
norm: castaglia
Industry: Professional Servicesllm

Discovered: Mar 26, 2026
Breach occurred: Feb 28, 2026 – Mar 8, 2026
Undetected for: 26 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2026
Affected individuals: 2state-resident count only
Data types: Government IDIdentity (basic)Financial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took action to contain it
Began an investigation
Reported the incident to law enforcement
Established a dedicated, toll-free call center for individuals to call with questions
Offering credit monitoring through Kroll to the Nebraska residents
Changes made: Taken, and will continue to take, steps to enhance the security of its computer network
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGApr 28 · first

Maine State AGApr 28 · first

Vermont State AGApr 28 · first

Nebraska State AGApr 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/64ac589a-174b-4bbf-b912-a70ec0c7dba1.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2026
Raw hash: 536e555d5ddcd6f09053b552d0a5bb10d1f0445b1b2d5cc228b5de226dc25b55

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityCastaglia, LLP

Victim entityCastaglia, LLP

Incidentdiscovered Mar 26, 2026

Stated responseTook action to contain it

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov