HackingProfessional ServicesProfessional ServicesStolen CredentialsTargetedIdentity (basic)Government IDMediumContained

Nelson & Townsend

bd_f456b1679a7eed09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 15, 2025

Filed

May 30, 2025

To disclose

19 weeks

Affected

89state residents only

Linked

2 filings

Confidence

66%

Full breach record for Nelson & Townsend →

Nelson & Townsend notified Montana residents of a data security incident where personal information, including names and Social Security numbers, was potentially accessed without authorization. Unauthorized access occurred on January 14, 2025, and was discovered on January 15, 2025. The company engaged cybersecurity specialists, conducted a review, and is offering credit monitoring services. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 19 weeks / 135 days

Jan 14, 2025

Begins

Jan 15, 2025

Discovered

May 30, 2025

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Nebraska State AGbd_1bccff9fc8af50832025-05-30Verified

Name: Nelson & Townsend
norm: nelson townsend

Name: Nelson & Townsend
norm: nelson townsend
Industry: Professional Servicesllm

Discovered: Jan 15, 2025
Breach occurred: Jan 14, 2025
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2025
Affected individuals: 89state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Initiated an investigation of the matter
Engaged cybersecurity specialists to assist with the incident response
Undertook a comprehensive review
Implemented additional measures to reduce the risk of a similar incident occurring in the future
Offering complimentary CyEx credit monitoring and identity protection services through Epiq
Changes made: Implemented additional measures to reduce the risk of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(135 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGMay 30 · first

Montana State AGMay 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/08/Consumer-notification-letter-48.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 30, 2025
Raw hash: 7986c9ee5b0d983ccbf94ea53f9c77e34aad0e255e7d741858a7cbb2460491a9

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityNelson & Townsend

Victim entityNelson & Townsend

Incidentdiscovered Jan 15, 2025

Stated responseInitiated an investigation of the matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov