U.S. consulting firm Greylock McKinnon Associates has reported a data breach in which hackers stole up to 341,650 Social Security numbers.
Maine’s official government website, which publishes data breach notifications, reported the data breach on Friday.
GMA recently informed affected individuals of a data breach through a mailed notice. According to the notice, GMA experienced a cyberattack in May 2023 and took immediate action to address the incident. 
For civil litigation purposes, GMA provides economic and legal support to various companies and U.S. government agencies, including the U.S. Department of Justice. According to the data breach notice, GMA notified the affected individuals that the U.S. Department of Justice (“DOJ”) acquired their personal information in connection with a civil litigation matter that GMA supports.
The reasons and targets of the Department of Justice’s civil litigation remain undisclosed. When asked for a comment, a Justice Department spokesperson did not respond.
GMA clarified that the individuals who received notifications about the data breach are not the focus of the investigation or the related legal proceedings. Additionally, GMA assured that the cyberattack would not have any effect on their current Medicare benefits or coverage.
We sought guidance from external cybersecurity experts to aid in our handling of the incident, and we promptly informed law enforcement and the Department of Justice. On February 7, 2024, the firm received confirmation about the affected individuals and their contact addresses.
GMA informed the victims that this incident most likely compromised their personal and Medicare information. The information that was potentially affected includes names, dates of birth, home addresses, certain medical details, health insurance information, and Medicare claim numbers, which also included Social Security numbers.
The reason for the delay in GMA’s investigation and notification of victims remains uncertain.
GMA and the firm’s external legal counsel, Linn Freedman of Robinson & Cole LLP, have not yet provided a response to the comment request.
