HackingProfessional ServicesProfessional ServicesTargetedData ExfiltratedIdentity (basic)Government IDMediumActive

McElroy, Deutsch, Mulvaney & Carpenter LLP

bd_efd18d3b3c3e0536 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2025

Filed

Dec 19, 2025

To disclose

37 weeks

Affected

3state residents only

Linked

6 filings

Confidence

66%

Full breach record for McElroy, Deutsch, Mulvaney & Carpenter LLP →

McElroy, Deutsch, Mulvaney & Carpenter LLP (MDMC) disclosed an external system breach affecting 3 Maine residents. Unauthorized access occurred March 28–April 1, 2025. MDMC discovered suspicious activity on April 3, 2025, and confirmed personal information (name, SSN) was accessed on December 4, 2025. Notices were sent December 19, 2025. MDMC engaged federal law enforcement and provided 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 3, 2025 → Filed with AG Dec 19, 2025260d ✗ ME AG >90d37 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 6 days

discovery → filing · 37 weeks / 260 days

Mar 28, 2025

Begins

Apr 3, 2025

Discovered

Dec 19, 2025

Filed

vs. sector median

+18 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_698f1a0d029620162025-12-19Verified
Nebraska State AGbd_6da1ae289ac345962025-12-19Verified
New Hampshire State AGbd_bd3f74df05a359e32025-12-19Verified
New Hampshire State AGbd_03b000a29a602b0c2026-03-12 · +83dCandidate

Show 1 more filing ↓up to 83d gap

Maine State AGbd_df428c93170c98cf2026-03-12 · +83dVerified

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Legal Services

Name: McElroy, Deutsch, Mulvaney & Carpenter LLP
norm: mcelroy deutsch mulvaney carpenter
Domain: mdmc-law.com
Industry: Legal Services
Industry: Professional Servicesllm

Discovered: Apr 3, 2025
Breach occurred: Mar 28, 2025 – Apr 1, 2025
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 19, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProvided written notice to relevant state regulators
Initial access: exploit_public_facing

During the incident: Moved quickly to respond and investigate the suspicious activity
Secured its network
Notified federal law enforcement
Provided access to credit monitoring services for twelve (12) months through Epiq
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Provided written notice to relevant state regulators
Provided written notice to the three major credit reporting agencies
Changes made: Reviewing its policies and procedures to reduce the likelihood of similar future events
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 37 weeks(260 days from discovery to filing)
Compliance flags: ME AG >90d · 260dME resident >180d · 260d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 3, 2025
→ Filed with AG: Dec 19, 2025
260d 90 days ME AG >90d
Maine
Discovered: Apr 3, 2025
→ Notified: Dec 19, 2025
260d 180 days ME resident >180d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 3, 2025 → Filed with AG: Dec 19, 2025	260d	90 days	ME AG >90d
Maine	Discovered: Apr 3, 2025 → Notified: Dec 19, 2025	260d	180 days	ME resident >180d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 4 states

View merged incident ↗

Indiana State AGDec 19 · first

Nebraska State AGDec 19 · first

New Hampshire State AGDec 19 · first

Maine State AGDec 19 · first · this page

New Hampshire State AG+83d

Maine State AG+83d

Pattern: first filing Dec 19 (IN), last Mar 12 (ME) — a 83-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7f0dc522-98c3-4df9-bd4f-65b45398da43.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2025
Raw hash: 022687ff06aa78287aec3b63666b71595782f397038f6e11b66ef6d3eb19a374

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Victim entityMcElroy, Deutsch, Mulvaney & Carpenter LLP

Incidentdiscovered Apr 3, 2025

Stated responseMoved quickly to respond and investigate the suspicious activity

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov