Social EngineeringEnergy & UtilitiesUtilitiesPhishingStolen CredentialsEmployee Data InvolvedIdentity (basic)LowResolved

Permian Resources Corporation

bd_105cf2906e98e00e · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 8, 2023

Filed

Mar 25, 2024

To disclose

15 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

67%

Full breach record for Permian Resources Corporation →

Permian Resources Corporation notified consumers of a security incident where an unknown third-party gained unauthorized access to a small number of employee email accounts via phishing emails on or about December 8 and 11, 2023. The incident may have exposed personal information including name and address. The company activated its incident response team, engaged forensic firms, and concluded its investigation with no confirmation that information was accessed or used. Credit monitoring services are being offered.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday15 weeks discovery → filing

Incident timeline

discovery → filing · 15 weeks / 108 days

Dec 8, 2023

Discovered

Mar 25, 2024

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_3370347684749bf02024-03-25Verified
Idaho State AGbd_6311d921a43f4be92024-04-03 · +9dCandidate

Name: Permian Resources Corporation
norm: permian resources

Name: Permian Resources Corporation
norm: permian resources
Industry: Energy & Utilitiesllm

Discovered: Dec 8, 2023
Materiality determined: —
Notification sent: Mar 25, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Initial access: phishing_link

During the incident: Activated its incident response team to secure the affected accounts and contain the incident
Conducted a legal and technical investigation of the incident, including engagements with leading forensic and data analytics firms
Sent timely alert communications to its employees
Provided additional training to Permian Resources employees impacted by the phishing attack
Changes made: Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge for 12 Months
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(108 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGMar 25 · first

Vermont State AGMar 25 · first · this page

Idaho State AG+9d

Pattern: first filing Mar 25 (IN), last Apr 3 (ID) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-03-25-permian-resources-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 25, 2024
Raw hash: 9675c32e740bd5946bfaa805534bf37dccf05251822d981c60a85e5fdad4eaec

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPermian Resources Corporation

Victim entityPermian Resources Corporation

Incidentdiscovered Dec 8, 2023

Stated responseActivated its incident response team to secure the affected accounts and contain the incident

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov