MalwareFinanceGovernment IDIdentity (basic)Financial accountPIIMediumContained

PKF O'CONNOR DAVIES ADVISORY, LLC

bd_ea6d1ae607add366 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 3, 2020

Filed

Apr 2, 2021

To disclose

17 weeks

Affected

4state residents only

Linked

4 filings

Confidence

66%

Full breach record for PKF O'CONNOR DAVIES ADVISORY, LLC →3 incidents on file

New Hampshire Attorney General notice regarding a cybersecurity incident affecting PKF O’Connor Davies (PKFOD). A third-party vendor, Netgain Technology, LLC, was breached by a threat actor who gained access to PKFOD's hosted environment on November 8, 2020. The actor exfiltrated and encrypted files containing personal information (SSN, financial accounts) of 4 New Hampshire residents. PKFOD provided 12 months of credit monitoring. Netgain remediated by rotating credentials and deploying threat-detection tools.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 25 days

discovery → filing · 17 weeks / 120 days

Nov 8, 2020

Begins

Dec 3, 2020

Discovered

Apr 2, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_69f151ab9e4dcd852021-04-02Candidate
Maine State AGbd_6ebd4187b44ee17f2021-04-02Verified
Massachusetts State AGbd_9a717a1954f0705b2021-04-02Verified

Name: Wilson, Elser, Moskowitz, Edelman & Dicker LLP
norm: wilson elser moskowitz edelman dicker
Domain: wilsonelser.com

Name: PKF O'CONNOR DAVIES ADVISORY, LLC
norm: pkf o connor davies advisory
Industry: professional_services

Discovered: Dec 3, 2020
Breach occurred: Nov 8, 2020 – Nov 23, 2020
Undetected for: 25 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 22, 2020
Affected individuals: 4state-resident count only
Data types: Government IDIdentity (basic)Financial accountPII
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: external_remote_services

During the incident: Provided complimentary credit monitoring to the impacted individuals for at least twelve (12) months
Changes made: Deploying threat-detecting tools across its environment
Rotating all user credentials
Running scripts to ensure that all backups were clean prior to restoring any infected systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(120 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGApr 2 · first

Maine State AGApr 2 · first

Massachusetts State AGApr 2 · first

New Hampshire State AGApr 2 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pkf-oconnor-davies-20210402.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2021
Raw hash: 1180731f0002191da7ba1861441c3471744622800456cfd083ca424edb15cf2b

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWilson, Elser, Moskowitz, Edelman & Dicker LLP

Victim entityPKF O'CONNOR DAVIES ADVISORY, LLC

Incidentdiscovered Dec 3, 2020

Stated responseProvided complimentary credit monitoring to the impacted individuals for at least twelve (12) months

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov