HackingOtherRansomwareData EncryptedTargetedIdentity (basic)MediumContained

Jacobsen Construction

bd_0ccd3c36931cc9f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2024

Filed

Jun 14, 2024

To disclose

7 weeks

Affected · nationwide

9,6671 in this filing

Linked

7 filings

Confidence

65%

Full breach record for Jacobsen Construction →

Jacobsen Construction Co., Inc. reported an external system breach (hacking) occurring between September 21 and November 26, 2023. The incident was discovered on April 29, 2024. An unauthorized third party accessed systems and attempted to encrypt files, potentially acquiring personal information including names and other identifiers. 9,667 individuals were affected, including 1 Maine resident. The company engaged forensic investigators, notified law enforcement, and offered one year of identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Apr 29, 2024 → Filed with AG Jun 14, 202446d ⏱ ME AG >30d7 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 221 days

discovery → filing · 7 weeks / 46 days

Sep 21, 2023

Begins

Apr 29, 2024

Discovered

Jun 14, 2024

Filed

vs. sector median

1 wks faster

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteinc_ransombd_8f3c36e79f759a3f2023-09-28 · +260dVerified by operator

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_1aa7c32a34c2f5662024-06-14Verified by operator
Massachusetts State AGbd_27d9b9096367d5ff2024-06-14Verified by operator
New Hampshire State AGbd_33264793c8e227d52024-06-14Verified
Indiana State AGbd_8b10e59b4e563d642024-06-14Verified

Show 1 more filing ↓up to 98d gap

HHS OCRbd_1f00a6633fd539ca2024-09-20 · +98dVerified by operator

Name: Jacobsen Construction
norm: jacobsen construction
Domain: jacobsenconstruction.com

Name: Jacobsen Construction
norm: jacobsen construction
Domain: jacobsenconstruction.com
Industry: Otherllm

Discovered: Apr 29, 2024
Breach occurred: Sep 21, 2023 – Nov 26, 2023
Undetected for: 221 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 14, 2024
Affected individuals: 9,667state + nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: External
Regulator citations: Filed notification with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Began an investigation
Notified law enforcement
Worked to secure our systems
Engaged a forensic security firm to assist with our investigation
Changes made: Working closely with cybersecurity professionals to identify and implement additional controls to improve our security posture
Offering a complimentary one-year membership of CyEx Identity Defense Total
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: ME AG >30d · 46d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Apr 29, 2024
→ Filed with AG: Jun 14, 2024
46d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Apr 29, 2024 → Filed with AG: Jun 14, 2024	46d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGJun 14 · first

Massachusetts State AGJun 14 · first

New Hampshire State AGJun 14 · first

Indiana State AGJun 14 · first

Maine State AGJun 14 · first · this page

HHS OCR+98d

Pattern: first filing Jun 14 (MT), last Sep 20 (UT) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f6db22d1-7945-48b6-b727-0b134a5b4e38.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2024
Raw hash: b15878cbc880f57a549843ee4fd0924b665ed69f09d918e6660f75f7c45ecb91

Linked disclosures

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Reporting entityJacobsen Construction

Victim entityJacobsen Construction

Incidentdiscovered Apr 29, 2024

Stated responseBegan an investigation

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov