{"id":1000897286,"date":"2024-10-02T12:22:38","date_gmt":"2024-10-02T16:22:38","guid":{"rendered":"https:\/\/www.goingconcern.com\/?p=1000897286"},"modified":"2024-10-02T12:22:38","modified_gmt":"2024-10-02T16:22:38","slug":"a-firm-with-55-people-finds-itself-at-the-center-of-a-data-breach-affecting-127431","status":"publish","type":"post","link":"https:\/\/www.goingconcern.com\/a-firm-with-55-people-finds-itself-at-the-center-of-a-data-breach-affecting-127431\/","title":{"rendered":"A Firm With 55 People Finds Itself at the Center of a Data Breach Affecting 127,431"},"content":{"rendered":"\n

It seems like every other day we’re seeing a new story about an accounting firm that’s suffered a data breach. Just the other day, CBIZ revealed bad actors exploited a vulnerability on one of its web pages<\/a> and acquired information from retiree health and welfare plan databases including Social Security numbers. They did not report the number of total affected individuals.<\/p>\n\n\n\n

The most recent incident was the second time SS numbers were stolen from CBIZ (that we know of), the first being last year’s MOVEiT breach that affected EY and PwC as well<\/a>.<\/p>\n\n\n\n

On September 19, a tiny little firm in Louisiana called Wright, Moore, DeHart, Dupuis & Hutchinson, LLC informed 127,431 people that their personal data including first and last name, Social Security number, driver\u2019s license number, financial account number, passport number, and medical\/treatment information may have been accessed by unauthorized explorers digging through their systems. The “what happened” section of the data breach notification doesn’t give many details, only that the firm noticed “unusual network activity” on or around July 11 of last year. The notification filed with the Maine Attorney General states<\/a> the breach was discovered on September 10, 2024 but the firm said in the notification that an independent review into what data had been compromised was completed on July 18, 2024.<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n

This is what they said:<\/p>\n\n\n\n

\n

On or around July 11, 2023, WMDDH became aware of unusual network activity and immediately took steps to secure our systems. We launched an investigation with the assistance of leading cybersecurity experts to determine what happened and whether sensitive or personal information may have been affected during the incident. As a result of the investigation, we identified that certain WMDDH data may have been acquired without authorization. WMDDH then engaged an independent team to conduct a comprehensive review of all potentially affected data, and on May 8, 2024, that review determined that your personal information may have been affected. WMDDH then worked diligently to identify contact information to effectuate notification and prepare the services being offered to affected individuals, as provided in more detail below. This process was completed on July 18, 2024.<\/p>\n<\/blockquote>\n\n\n\n

Why does an accounting firm with 55 people working there (including partners and support staff) have Social Security numbers, driver\u2019s license numbers, financial account numbers, passport numbers, and medical\/treatment information data for nearly 130,000 people? It doesn’t say. But really makes you think about who has your<\/strong> data and what they’re doing to protect it.<\/p>\n\n\n\n

Law firms are already promoting a potential class action suit<\/a>.<\/p>\n\n\n\n

Earlier:<\/p>\n\n\n\n

\n
This Might Be the Strangest Review of an Accounting Firm Yet<\/a><\/blockquote>