AccidentalConstructionConstructionMisconfigurationCustomer Data InvolvedPIIIdentity (basic)LowResolved

Summit Line Construction

bd_10ba88aa81db07a4 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 28, 2022

Filed

Aug 4, 2022

To disclose

5 weeks

Affected

3state residents only

Confidence

65%

Full breach record for Summit Line Construction →

Summit Line Construction notified Montana residents of a data security incident where a software programming error in its onboarding service caused erroneous downloads of new employee files between April 4 and June 28, 2022. The company discovered the error on June 28, 2022, and engaged IDX to provide 24 months of identity protection services to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 85 days

discovery → filing · 5 weeks / 37 days

Apr 4, 2022

Begins

Jun 28, 2022

Discovered

Aug 4, 2022

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Summit Line Construction
norm: summit line construction

Name: Summit Line Construction
norm: summit line construction
Industry: Constructionllm

Discovered: Jun 28, 2022
Breach occurred: Apr 4, 2022 – Jun 28, 2022
Undetected for: 85 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 4, 2022
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection

During the incident: Launched an investigation to determine the nature and scope of the incident
Arranged for IDX to protect your identity and help you recover from potential identity theft
Provided 24 months of complimentary identity protection services including credit monitoring and CyberScan monitoring assistance
Changes made: Application Provider removed the problematic download option
Addressed the software programming issue
Continue to look for ways to improve processes and procedures with respect to service providers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-474.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2022
Raw hash: 42255ac3367fbdd573ce22d6acb8c546835ab7649560f9512f23071a4fa73c74

Reporting entitySummit Line Construction

Victim entitySummit Line Construction

Incidentdiscovered Jun 28, 2022

Stated responseLaunched an investigation to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov