Social EngineeringProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedTargetedGovernment IDPIIMediumResolved

Kline, Keppel & Koryak, P.C.

bd_f076bc257a55a6dd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 11, 2020

Filed

Aug 13, 2020

To disclose

26 weeks

Affected

83state residents only

Linked

2 filings

Confidence

65%

Full breach record for Kline, Keppel & Koryak, P.C. →2 incidents on file

Kline, Keppel & Koryak, P.C. notified individuals of unauthorized access to employee email accounts occurring between Oct 26, 2019 and Feb 13, 2020. Discovered Feb 11, 2020. SSNs were accessed. Response included forensic investigation, password resets, law enforcement notification, and credit monitoring offers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 108 days

discovery → filing · 26 weeks / 184 days

Oct 26, 2019

Begins

Feb 11, 2020

Discovered

Aug 13, 2020

Filed

vs. sector median

+8 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_8f88da6d00e1cbd92020-08-13Verified

Name: Kline, Keppel & Koryak, P.C.
norm: kline keppel koryak

Name: Kline, Keppel & Koryak, P.C.
norm: kline keppel koryak
Industry: Professional Servicesllm

Discovered: Feb 11, 2020
Breach occurred: Oct 26, 2019 – Feb 13, 2020
Undetected for: 108 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 12, 2020
Affected individuals: 83state-resident count only
Data types: Government IDPII
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: notifying law enforcement
Initial access: phishing_link

During the incident: Began an investigation, with the support of computer forensic investigators
Took steps to further enhance the security of all of Kline Keppel email accounts and its systems
Undertook a time-intensive, thorough review of the impacted email accounts and its internal files and systems
Resetting account passwords
Notifying law enforcement
Bringing in third-party investigators
Tak en additional actions to enhance our security policies , procedures and infrastructure, including in relation to employee email access
Offering you access to complimentary credit monitoring and identity restoration services through ID Experts
Changes made: Enhance our security policies , procedures and infrastructure, including in relation to employee email access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(184 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGAug 13 · first

Montana State AGAug 13 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Kline-Keppel-Koryak-Consumer-ltr.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 13, 2020
Raw hash: 18ef8b6aff2fa6b2d565ae6d328bf81d75e5af9c34041b89cb0e52e735eea1fe

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKline, Keppel & Koryak, P.C.

Victim entityKline, Keppel & Koryak, P.C.

Incidentdiscovered Feb 11, 2020

Stated responseBegan an investigation, with the support of computer forensic investigators

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov