On September 20, 2024, the Vermont Office of the Attorney General disclosed a data breach at Heard, McElroy & Vestal LLC (HMV), a law firm. The incident was detected around February 21, 2024, after a suspicious email was found in an employee’s inbox, suggesting a phishing-related compromise. The breach impacted approximately 191 Texas residents, with exposed data potentially including names and other personal information. The attack appears to have exploited human error or weak email security protocols, allowing unauthorized access to sensitive client data. While the exact scope of the stolen information remains undisclosed, the exposure of personal identifiers poses risks such as identity theft, fraud, or targeted scams. The firm likely faced reputational damage and potential legal repercussions due to the failure to safeguard client data. No evidence suggests ransomware, systemic network takeover, or large-scale financial fraud, but the incident underscores vulnerabilities in employee cybersecurity awareness and data protection measures within professional service firms.
Source: https://ago.vermont.gov/document/2024-09-2024-heard-mcelroy-vestal-data-breach-notice-consumers
TPRM report: https://www.rankiteo.com/company/heard-mcelroy-vestal-llc-cpa
"id": "hea026091825",
"linkid": "heard-mcelroy-vestal-llc-cpa",
"type": "Breach",
"date": "2/2024",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '191 (Texas residents)',
'industry': 'Legal Services',
'name': 'Heard, McElroy & Vestal LLC (HMV)',
'type': 'Law Firm'}],
'data_breach': {'number_of_records_exposed': '191',
'personally_identifiable_information': True,
'sensitivity_of_data': 'Moderate (personal data)',
'type_of_data_compromised': ['names', 'other personal data']},
'date_detected': '2024-02-21',
'date_publicly_disclosed': '2024-09-20',
'description': 'On September 20, 2024, the Vermont Office of the Attorney '
'General reported a data breach incident involving Heard, '
'McElroy & Vestal LLC (HMV). The breach was identified on or '
'around February 21, 2024, due to a suspicious email in an '
"employee's mailbox, potentially affecting approximately 191 "
'Texas residents. The information compromised may have '
'included names and other personal data.',
'impact': {'data_compromised': ['names', 'other personal data'],
'identity_theft_risk': 'Potential (personal data exposed)'},
'initial_access_broker': {'entry_point': "Suspicious email in an employee's "
'mailbox'},
'references': [{'date_accessed': '2024-09-20',
'source': 'Vermont Office of the Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': 'Vermont Office of the '
'Attorney General'},
'response': {'communication_strategy': 'Public disclosure via Vermont Office '
'of the Attorney General'},
'title': 'Data Breach at Heard, McElroy & Vestal LLC (HMV)',
'type': 'Data Breach'}