HackingProfessional ServicesProfessional ServicesStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Hattrup & Associates, P.S.

bd_fa03c88d6651d6fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 27, 2021

Filed

Sep 24, 2021

To disclose

28 days

Affected

1state residents only

Linked

3 filings

Confidence

66%

Full breach record for Hattrup & Associates, P.S. →

Hattrup & Associates, P.S. notified clients that an unauthorized third party accessed its network between Feb 5 and Apr 1, 2021, resulting in fraudulent tax filings. The firm notified the IRS, engaged cybersecurity professionals, and offered one year of Equifax credit monitoring. Affected data included names, SSNs, and financial info.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 203 days

discovery → filing · 28 days

Feb 5, 2021

Begins

Aug 27, 2021

Discovered

Sep 24, 2021

Filed

vs. sector median

15 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_4933518832a20a892021-09-24Candidate
Indiana State AGbd_667ed41d10ee856b2021-09-24Verified

Name: Hattrup & Associates, P.S.
norm: hattrup associates ps

Name: Hattrup & Associates, P.S.
norm: hattrup associates ps
Industry: Professional Servicesllm

Discovered: Aug 27, 2021
Breach occurred: Feb 5, 2021 – Apr 1, 2021
Undetected for: 203 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified the Internal Revenue Service
Initial access: valid_credentials

During the incident: Promptly commenced an investigation
Immediately notified the Internal Revenue Service
Working very closely with external cybersecurity professionals
Analyze our internal systems for any unusual or unauthorized activity
Offering a complimentary one-year membership of Equifax Credit WatchTM Gold
Filed an Identity Theft Affidavit (Form 14039) with the IRS on your behalf
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGSep 24 · first

Indiana State AGSep 24 · first

Montana State AGSep 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-114.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 24, 2021
Raw hash: f482173c4dbcb9e5a7460c2f053bd07d9ca04296cb598857d1e08b837e7d6c7c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHattrup & Associates, P.S.

Victim entityHattrup & Associates, P.S.

Incidentdiscovered Aug 27, 2021

Stated responsePromptly commenced an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov