HackingIdentity (basic)Government IDFinancial accountCredentialsPHIHealth (basic)MediumContained

Gleason, Flynn, Emig & Mcafee, Chartered

bd_f87f1d81f9fc4c30 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Oct 31, 2024

Filed

May 29, 2025

To disclose

—

Affected

3state residents only

Linked

4 filings

Confidence

67%

Full breach record for Gleason, Flynn, Emig & Mcafee, Chartered →2 incidents on file

Gleason, Flynn, Emig, and McAfee, Chartered (GFEM), a law firm, reported a data security incident to the Nebraska Attorney General on May 29, 2025. Suspicious activity was discovered on October 31, 2024, leading to an investigation that determined unauthorized access occurred. Three Nebraska residents were affected, with data including names, SSNs, passport numbers, driver's license numbers, financial account info, and medical/insurance data potentially exposed. GFEM engaged forensic specialists, notified the FBI, reset passwords, deployed endpoint monitoring, and offered 12 months of credit monitoring via Cyberscout/TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 31, 2024

Discovered

May 29, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_651a10d6e757e8842025-05-29Verified
Maine State AGbd_68c7c9c50afa8d712025-05-29Candidate
Vermont State AGbd_6971fe4980de91222025-05-29Verified

Name: Gleason, Flynn, Emig & Mcafee, Chartered
norm: gleason flynn emig mcafee chartered

Name: Gleason, Flynn, Emig & Mcafee, Chartered
norm: gleason flynn emig mcafee chartered

Discovered: Oct 31, 2024
Materiality determined: —
Notification sent: May 29, 2025
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial accountCredentialsPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: The FBI was also notified of this incident
Initial access: valid_credentials

During the incident: Implemented its incident response protocols
Began an internal investigation
External computer forensic specialists were engaged
Changed all passwords
Deployed enhanced endpoint monitoring software
The FBI was also notified of this incident
Offered 12 months of credit monitoring and identity protection services through Cyberscout
Changes made: Changed all passwords
Deployed enhanced endpoint monitoring software
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMay 29 · first

Maine State AGMay 29 · first

Vermont State AGMay 29 · first

Nebraska State AGMay 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/88762fa3-43ea-41a0-8bce-e24aca13ee2c.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2025
Raw hash: d42dce182ae6b647809af6697d83657c1c01c424d5ce519381ea3a14ab1633e0

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityGleason, Flynn, Emig & Mcafee, Chartered

Victim entityGleason, Flynn, Emig & Mcafee, Chartered

Incidentdiscovered Oct 31, 2024

Stated responseImplemented its incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov