HackingProfessional ServicesProfessional ServicesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

D&K Engineering

bd_21e5377418786a09 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 19, 2021

Filed

Jul 27, 2021

To disclose

10 weeks

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for D&K Engineering →

D&K Engineering notified Montana AG of a data security incident discovered May 19, 2021, involving unauthorized access to employment-related PII (names, DOB, SSN, health insurance). The company engaged forensic experts, notified the FBI, and offered 12 months of identity protection to US employees. This is a supplemental notice.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 69 days

May 19, 2021

Discovered

Jul 27, 2021

Filed

vs. sector median

9 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_6d5a0cacd3b8b4112021-07-27Verified
Indiana State AGbd_e88af83c3bfe02f12021-07-27Verified
Massachusetts State AGbd_f098b5fc2362078b2021-07-27Verified

Name: D&K Engineering
norm: d k engineering

Name: D&K Engineering
norm: d k engineering
Industry: Professional Servicesllm

Discovered: May 19, 2021
Materiality determined: —
Notification sent: Jul 27, 2021
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified local law enforcement agencies including the FBI
Initial access: valid_credentials

During the incident: Took systems offline
Launched an internal investigation with the assistance of independent computer forensic experts
Notified local law enforcement agencies including the FBI
Offering identity theft protection services to all its US employees through IDX
Changes made: Implemented further measures to enhance our overall cybersecurity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(69 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGJul 27 · first

Indiana State AGJul 27 · first

Massachusetts State AGJul 27 · first

Montana State AGJul 27 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-117.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2021
Raw hash: ad4c5d0c92d6c86d6f4f330f1d76c2a112b2a2f4a0887e345e0f9d7892a09f59

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityD&K Engineering

Victim entityD&K Engineering

Incidentdiscovered May 19, 2021

Stated responseTook systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov