Devine, Millimet & Branch, P.A.

The Maine Office of the Attorney General disclosed a data breach at Devine Millimet & Branch, a law firm, where unauthorized actors gained access to its network between August 13, 2020, and September 6, 2020. The incident exposed sensitive personal information of 19,396 individuals, including 261 Maine residents, with Social Security numbers (SSNs) among the compromised data. The breach was not publicly reported until June 24, 2021, nearly 10 months after the initial intrusion, raising concerns about delayed notification and potential misuse of the stolen data. The exposure of SSNs poses significant risks, including identity theft, financial fraud, and long-term reputational harm to affected individuals. As a law firm, the breach also undermines client trust and may lead to legal liabilities, regulatory scrutiny, and financial penalties under data protection laws. The prolonged unauthorized access suggests possible advanced persistent threat (APT) activity, though the exact attack vector (e.g., phishing, exploited vulnerability) was not specified. The incident highlights vulnerabilities in the firm’s cybersecurity posture, particularly in detection, response, and disclosure protocols.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/8a29714a-42e6-418e-93ac-49d235603425.shtml

TPRM report: https://www.rankiteo.com/company/devinemillimet

"id": "dev025090625",
"linkid": "devinemillimet",
"type": "Breach",
"date": "8/2020",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '19,396 individuals (including '
                                              '261 Maine residents)',
                        'industry': 'Legal Services',
                        'name': 'Devine Millimet & Branch',
                        'type': 'Law Firm'}],
 'customer_advisories': 'Notification letters sent (June 24, 2021)',
 'data_breach': {'number_of_records_exposed': '19,396',
                 'personally_identifiable_information': 'Yes (Social Security '
                                                        'numbers)',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security numbers']},
 'date_publicly_disclosed': '2021-06-24',
 'description': 'The Maine Office of the Attorney General reported that Devine '
                'Millimet & Branch experienced a data breach involving '
                'unauthorized access to their network from August 13, 2020, to '
                'September 6, 2020. The breach potentially affected 19,396 '
                'individuals, including 261 residents of Maine, with '
                'compromised information including Social Security numbers.',
 'impact': {'data_compromised': ['Social Security numbers'],
            'identity_theft_risk': 'High (Social Security numbers exposed)'},
 'references': [{'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': 'Maine Office of the '
                                                       'Attorney General'},
 'response': {'communication_strategy': 'Notification letters sent to affected '
                                        'individuals (June 24, 2021)'},
 'title': 'Data Breach at Devine Millimet & Branch',
 'type': 'Data Breach'}