Cyber Incident Victim: Bansley and Kiener LLP
Date:
Dec 2020
Location:
United States of America
Summary
Bansley and Kiener LLP experienced a ransomware attack that encrypted some systems, causing temporary disruption before operations were restored using backups. Initially, no data theft was detected, but subsequent investigations revealed attackers had exfiltrated files containing sensitive client information, including names and Social Security numbers. The breach impacted 70,941 individuals, prompting enhanced security measures and workforce cybersecurity training. Affected parties were notified and offered complimentary credit monitoring and identity theft protection services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 10, 2020, Bansley and Kiener LLP, a Chicago-based accounting firm, experienced a ransomware attack that encrypted certain files within its systems. The attack caused temporary operational disruption, but the firm restored all encrypted systems from backups and rapidly resumed normal operations. Initial investigations conducted after the incident found no evidence of data theft and confirmed the breach had been fully contained. However, on May 24, 2021, the firm learned through subsequent analysis that attackers had successfully exfiltrated files containing sensitive client information during the December intrusion. A third-party cybersecurity firm assisted with this expanded investigation, which confirmed by August 24, 2021, that attackers potentially accessed names and Social Security numbers of individuals, though investigators couldn't definitively determine all specific data types compromised.
The firm reported the breach to the HHS Office for Civil Rights through four separate filings affecting 70,941 individuals collectively. On December 3, 2021, Bansley and Kiener began notifying affected individuals via breach letters that detailed protective measures, including complimentary credit monitoring and identity theft protection services. In response to the incident, the firm conducted a comprehensive security review and implemented strengthened cybersecurity measures to prevent future breaches. Ongoing workforce cybersecurity education programs were expanded as part of these operational changes. The ransomware attack's full impact was realized nearly a year after initial containment when data exfiltration confirmation necessitated regulatory reporting and consumer notifications.