HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedFinancialPIILowContained

Keeler Accounting Associates, LLC

bd_f168ff685b8096ee · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 2, 2025

Filed

Oct 2, 2025

To disclose

4 weeks

Affected

450state residents only

Confidence

67%

Keeler Accounting Associates, LLC notified the NH AG of a security incident on Sept 2, 2025, where unauthorized ScreenConnect software was installed on three workstations, allowing external remote access. Approx. 450 NH residents affected. Client financial data on Q: drive may have been accessed. No evidence of misuse found. Remediation included reimaging systems, password resets, MFA enforcement, and EDR deployment.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 30 days

Sep 2, 2025

Discovered

Oct 2, 2025

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed450 affectedView incident

Name: Keeler Accounting Associates, LLC
norm: keeler accounting associates
Domain: keelercpa.com

Name: Keeler Accounting Associates, LLC
norm: keeler accounting associates
Domain: keelercpa.com
Industry: Professional Servicesllm

Discovered: Sep 2, 2025
Materiality determined: —
Notification sent: Sep 10, 2025
Affected individuals: 450state-resident count only
Data types: FinancialPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed notice with New Hampshire Attorney General pursuant to RSA 359-C;20
Initial access: external_remote_services

During the incident: Affected machines were reimaged and cleaned
Password resets across systems
Security enhancements in progress, including firewall deployment, endpoint detection and response (EDR), DNS filtering, and user training
On September 10, 2025, letters were mailed to all clients informing them of the incident
Changes made: Enforcing multi-factor authentication across accounts
Deploying advanced endpoint protection (EDR) on all machines
Installing a next-generation firewall with monitoring
Enhancing staff training and security policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/keeler-accounting-20251002.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 2, 2025
Raw hash: 65bd4b68509b0e8f09ad3fcf02f217177228030f536fe44b610f96b7632c4b59

Reporting entityKeeler Accounting Associates, LLC

Victim entityKeeler Accounting Associates, LLC

Incidentdiscovered Sep 2, 2025

Stated responseAffected machines were reimaged and cleaned

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov