HackingConstructionConstructionStolen CredentialsData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

PCE Constructors

bd_24d78467797020a2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 16, 2025

Filed

Sep 18, 2025

To disclose

13 weeks

Affected

42state residents only

Linked

4 filings

Confidence

66%

Full breach record for PCE Constructors →

PCE Constructors, Inc. notified Montana residents of a data privacy incident where unauthorized actors accessed employee personal information, including names, SSNs, and driver's license numbers, between June 12-17, 2025. The company secured systems, engaged forensic investigators, notified law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 13 weeks / 94 days

Jun 12, 2025

Begins

Jun 16, 2025

Discovered

Sep 18, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_1d829445466c88852025-09-18Verified
Nebraska State AGbd_760e36adebfbb68c2025-09-18Verified
Texas State AGbd_bce2ae8c067207402025-09-19 · +1dVerified

Name: PCE Constructors
norm: pce constructors

Name: PCE Constructors
norm: pce constructors
Industry: Constructionllm

Discovered: Jun 16, 2025
Breach occurred: Jun 12, 2025 – Jun 17, 2025
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 42state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notify federal law enforcement
Initial access: valid_credentials

During the incident: Secured our systems
Taking part of our network offline
Retained cybersecurity professionals to assist
Notify federal law enforcement
Changes made: Offering complimentary identity monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGSep 18 · first

Nebraska State AGSep 18 · first

Montana State AGSep 18 · first · this page

Texas State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/2025/09/Consumer-notification-letter-50.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2025
Raw hash: 6bbf5b233a19ab206399f41f309da938b8e67f6e1777e5ba93d4587b96d6be15

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityPCE Constructors

Victim entityPCE Constructors

Incidentdiscovered Jun 16, 2025

Stated responseSecured our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov