Social EngineeringConstructionConstructionPhishingTargetedCustomer Data InvolvedPIIIdentity (basic)Government IDFinancialMediumContained

MYR GROUP INC.

bd_42903a5c4992a938 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 5, 2016

Filed

May 12, 2016

To disclose

7 days

Affected

28state residents only

Confidence

66%

Full breach record for MYR GROUP INC. →2 incidents on file

MYR Group, Inc. notified employees of a phishing incident where spoofed emails from the CEO tricked payroll staff into releasing 2015 W-2 forms containing names, SSNs, and wage data. The breach occurred on April 14, 2016, was discovered on May 5, 2016, and notification was sent on May 11, 2016. The company engaged law enforcement (FBI, IRS) and provided 24 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 7 days

Apr 14, 2016

Begins

May 5, 2016

Discovered

May 12, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed28 affectedView incident

Name: MYR GROUP INC.
norm: myr group
Domain: myrgroup.com

Name: MYR GROUP INC.
norm: myr group
Domain: myrgroup.com
Industry: Constructionllm

Discovered: May 5, 2016
Breach occurred: Apr 14, 2016
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 11, 2016
Affected individuals: 28state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: reported the incident to law enforcement and state attorney generalsreported the incident to the FBI and IRS
Initial access: phishing_link

During the incident: Reported the incident to law enforcement and state attorney generals
Reported the incident to the FBI and IRS
Investigating how this incident occurred and engaging outside professionals to assist in assessing ways to prevent or guard against future incidents
Enrolling all affected individuals in a 24-month identity theft protection and monitoring program
Changes made: Engaging outside professionals to assist in assessing ways to prevent or guard against future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/MYR-Group.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2016
Raw hash: 2190df081a3644f5722ed703574ffcdb3c373543d718e280c845c9cdc828a55d

Reporting entityMYR GROUP INC.

Victim entityMYR GROUP INC.

Incidentdiscovered May 5, 2016

Stated responseReported the incident to law enforcement and state attorney generals

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov