MalwareProfessional ServicesProfessional ServicesRansomwareData ExfiltratedRansom DemandedIdentity (basic)Government IDMediumContained

Campbell Conroy & O’Neil

bd_e8d8dbb16c1c7bbf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 27, 2021

Filed

Jul 22, 2021

To disclose

21 weeks

Affected

11state residents only

Linked

4 filings

Confidence

67%

Full breach record for Campbell Conroy & O’Neil →

Campbell Conroy & O’Neil experienced a ransomware incident discovered on Feb 27, 2021. Unauthorized access impacted personal info (name, address, SSN, driver's license) of at least 11 NH residents. The firm engaged forensic investigators, notified the FBI, and provided 24 months of credit monitoring. Notification sent July 16, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 weeks / 145 days

Feb 27, 2021

Discovered

Jul 22, 2021

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_036de4002ed151ca2021-07-16 · +6dVerified
Maine State AGbd_29cc07eca3bda79b2021-07-16 · +6dCandidate
Indiana State AGbd_b87e686b837211912021-08-25 · +34dVerified

Name: Mullen Coughlin LLC
norm: mullen coughlin

Name: Campbell Conroy & O’Neil
norm: campbell conroy o neil
Industry: Professional Servicesllm

Discovered: Feb 27, 2021
Materiality determined: —
Notification sent: Jul 16, 2021
Affected individuals: 11state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Office of the New Hampshire Attorney GeneralAlerted the FBI

During the incident: Began working with third-party forensic investigators to investigate the full nature and scope of the event
Alerted the FBI of the incident
Provided written notice of this incident to all affected individuals
Providing access to credit monitoring services for twenty-four months, through Cyberscout, to individuals whose personal information was potentially affected by this incident, at no cost to these individuals
Changes made: Working to implement additional safeguards and training to its employees
Reviewing our existing policies and procedures, and are working to implement additional safeguards to further secure our information systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(145 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 16 · first

Maine State AGJul 16 · first

New Hampshire State AG+6d · this page

Indiana State AG+40d

Pattern: first filing Jul 16 (MA), last Aug 25 (IN) — a 40-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/campbell-conroy-oneil-20210722.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 22, 2021
Raw hash: 5faefc5647e84ea6503e204977700ccba85eb10d8c2035295df7de559d523bf9

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMullen Coughlin LLC

Victim entityCampbell Conroy & O’Neil

Incidentdiscovered Feb 27, 2021

Stated responseBegan working with third-party forensic investigators to investigate the full nature and scope of the event

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov