Atkinson, Andelson, Loya, Ruud & Romo

The California Office of the Attorney General disclosed a data breach at the law firm Atkinson, Andelson, Loya, Ruud & Romo in July 2015, stemming from the theft of a laptop on April 23, 2015. The compromised device potentially contained personally identifiable information (PII) of individuals, including names, addresses, telephone numbers, and Social Security numbers (SSNs). The exact number of affected individuals remains undetermined, but the exposure of SSNs poses a significant risk of identity theft, financial fraud, or targeted phishing attacks. As a law firm, the breach raises concerns about client confidentiality, regulatory compliance (e.g., state data protection laws), and reputational damage. The incident highlights vulnerabilities in physical security controls for devices storing sensitive data, emphasizing the need for encryption, access restrictions, and breach response protocols to mitigate fallout from such events.

Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-57094

TPRM report: https://www.rankiteo.com/company/atkinson-andelson-loya-ruud-&-romo

"id": "atk717082025",
"linkid": "atkinson-andelson-loya-ruud-&-romo",
"type": "Breach",
"date": "4/2015",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Unknown (PII of individuals)',
                        'industry': 'Legal Services',
                        'location': 'California, USA',
                        'name': 'Atkinson, Andelson, Loya, Ruud & Romo',
                        'type': 'Law Firm'}],
 'attack_vector': 'Theft of Physical Device (Laptop)',
 'data_breach': {'data_encryption': 'No (Laptop Likely Unencrypted)',
                 'number_of_records_exposed': 'Unknown',
                 'personally_identifiable_information': ['Names',
                                                         'Addresses',
                                                         'Telephone Numbers',
                                                         'Social Security '
                                                         'Numbers'],
                 'sensitivity_of_data': 'High (Includes SSNs)',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)']},
 'date_detected': '2015-04-23',
 'date_publicly_disclosed': '2015-07-21',
 'description': 'The California Office of the Attorney General reported a data '
                'breach involving Atkinson, Andelson, Loya, Ruud & Romo on '
                'July 21, 2015. The breach occurred on April 23, 2015, due to '
                'the theft of a laptop, which may have contained personally '
                'identifiable information (PII) of individuals, including '
                'names, addresses, telephone numbers, and social security '
                'numbers. The number of individuals affected is currently '
                'unknown.',
 'impact': {'brand_reputation_impact': 'Potential Reputation Damage (PII '
                                       'Exposure)',
            'data_compromised': ['Names',
                                 'Addresses',
                                 'Telephone Numbers',
                                 'Social Security Numbers'],
            'identity_theft_risk': 'High (PII Including SSNs Compromised)',
            'systems_affected': ['Laptop']},
 'post_incident_analysis': {'root_causes': ['Theft of Unsecured Laptop '
                                            'Containing Sensitive PII',
                                            'Lack of Encryption or Physical '
                                            'Security Controls']},
 'references': [{'date_accessed': '2015-07-21',
                 'source': 'California Office of the Attorney General'}],
 'regulatory_compliance': {'regulations_violated': ['Potential Violation of '
                                                    'California Data Breach '
                                                    'Notification Laws (e.g., '
                                                    'CA Civil Code § 1798.82)'],
                           'regulatory_notifications': ['Reported to '
                                                        'California Office of '
                                                        'the Attorney '
                                                        'General']},
 'response': {'communication_strategy': 'Public Disclosure via California '
                                        'Office of the Attorney General'},
 'title': 'Data Breach at Atkinson, Andelson, Loya, Ruud & Romo Due to Laptop '
          'Theft',
 'type': 'Data Breach (Physical Theft)',
 'vulnerability_exploited': 'Lack of Physical Security / Unencrypted Device'}