MalwareConstructionConstructionRansomwareData EncryptedTargetedIdentity (basic)Government IDPIIHighContained

RailWorks Corporation

bd_029317d5decd144d · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 27, 2020

Filed

Feb 27, 2020

To disclose

4 weeks

Affected

1,286state residents only

Linked

5 filings

Confidence

70%

Full breach record for RailWorks Corporation →

RailWorks Corporation reported a ransomware cyberattack on January 27, 2020, where an unauthorized third party encrypted servers containing personal information of employees and contractors. The breach affected 1,286 Washington residents. Data accessed included names, addresses, SSNs, driver's license numbers, and dates of birth. RailWorks notified affected individuals on February 27, 2020, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

Jan 27, 2020

Discovered

Feb 27, 2020

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_3a5051a75ec68cfe2020-02-27Verified
Indiana State AGbd_49756e0439968ef32020-02-27Verified
Montana State AGbd_bb7977b8709a7e092020-02-27Verified
California State AGbd_dd7e679267caadbd2020-02-27Verified

Name: RailWorks Corporation
norm: railworks

Name: RailWorks Corporation
norm: railworks
Industry: Constructionllm

Discovered: Jan 27, 2020
Materiality determined: —
Notification sent: Feb 27, 2020
Affected individuals: 1,286state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: NameSocial Security numberDriver's licence numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Reported to Washington Attorney General Office pursuant to Wash. Rev. Code § 19.255.010

During the incident: Offering the affected individuals credit monitoring at no charge for a period of twelve (12) months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGFeb 27 · first

Indiana State AGFeb 27 · first

Montana State AGFeb 27 · first

California State AGFeb 27 · first

Washington State AGFeb 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10535.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 27, 2020
Raw hash: 72e52249a6c747de32ac564fd63af94b7bfc543ceadd2838919a459c0f48adfe

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityRailWorks Corporation

Victim entityRailWorks Corporation

Incidentdiscovered Jan 27, 2020

Stated responseOffering the affected individuals credit monitoring at no charge for a period of twelve (12) months

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com