HackingProfessional ServicesProfessional ServicesData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountAuthenticationMediumContained

Davies, McFarland & Carroll LLC

bd_fe3d861d5d324329 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 22, 2025

Filed

Dec 1, 2025

To disclose

28 weeks

Affected

6state residents only

Linked

6 filings

Confidence

66%

Full breach record for Davies, McFarland & Carroll LLC →

Davies, McFarland & Carroll LLC (DMC), a law firm, notified the New Hampshire Attorney General of a cybersecurity incident affecting approximately 6 NH residents. Unauthorized access to DMC's internal network occurred between May 19-22, 2025. Personal information potentially accessed included names, DOBs, driver's licenses, financial account numbers, and SSNs. DMC engaged cybersecurity experts, contained the breach, and provided 12 months of credit monitoring to affected individuals. Notification letters were sent on November 24, 2025.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >90d28 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3 days

discovery → filing · 28 weeks / 193 days

May 19, 2025

Begins

May 22, 2025

Discovered

Dec 1, 2025

Filed

vs. sector median

+9 wks slower

This filing is one of 6 about the same incident.View merged incident

A leak claim by lynx about this victim predates this filing by 179 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitelynxbd_cb9011b811c83da72025-06-04 · +179dVerified by operator

Regulatory filings (4) · sorted by filing gap

HHS OCRbd_30ad7f17f1f262992025-11-24 · +7dVerified
Maine State AGbd_730c57b1011211ea2025-11-24 · +7dVerified
Nebraska State AGbd_790b2cf27259eae32025-11-24 · +7dVerified
Massachusetts State AGbd_82274baf56c02ddd2025-11-24 · +7dVerified by operator

Name: MCDONALD HOPKINS LLC
norm: mcdonald hopkins

Name: Davies, McFarland & Carroll LLC
norm: davies mcfarland carroll
Industry: Professional Servicesllm

Discovered: May 22, 2025
Breach occurred: May 19, 2025 – May 22, 2025
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 24, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government IDFinancial accountAuthentication
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Filed incident notification with New Hampshire Office of the Attorney General, Consumer Protection Bureau
Initial access: exploit_public_facing

During the incident: Engaged leading cybersecurity experts to identify what personal information, if any, was involved
Conducted a thorough investigation
Performed extensive forensic investigation and manual document review
Contained the incident
Provided affected residents with notification of this incident
Advised affected individuals to remain vigilant in reviewing financial account statements
Provided contact information for consumer reporting agencies and the Federal Trade Commission
Provided complimentary one-year membership with a credit monitoring service upon request
Changes made: Continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 weeks(193 days from discovery to filing)
Compliance flags: Leak >90d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

HHS OCRNov 24 · first

Maine State AGNov 24 · first

Nebraska State AGNov 24 · first

Massachusetts State AGNov 24 · first

New Hampshire State AG+7d · this page

Pattern: first filing Nov 24 (PA), last Dec 1 (NH) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/davies-mcfarland-carroll-20251201.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 1, 2025
Raw hash: 754c46fde61a551257b790511c54537660934d82187dbdfb75fa3a168ce8e565

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityMCDONALD HOPKINS LLC

Victim entityDavies, McFarland & Carroll LLC

Incidentdiscovered May 22, 2025

Stated responseEngaged leading cybersecurity experts to identify what personal information, if any, was involved

ComplianceLeak >90d

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov