MisuseProfessional ServicesProfessional ServicesData MishandlingEmployee Data InvolvedTargetedPIIIdentity (basic)Government IDEmploymentMediumActive

Keystone Peer Review Organization

bd_527cb397a33d9b14 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 10, 2019

Filed

Jun 12, 2019

To disclose

5 weeks

Affected

3state residents only

Confidence

64%

Full breach record for Keystone Peer Review Organization →

KEPRO notified Montana residents that a temporary employee shared I-9 forms containing PII (SSN, DOB, citizenship) with an unauthorized third party in April/May 2019. KEPRO discovered the incident on May 10, 2019, launched an internal investigation, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 39 days

discovery → filing · 5 weeks / 33 days

Apr 1, 2019

Begins

May 10, 2019

Discovered

Jun 12, 2019

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident

Name: Keystone Peer Review Organization
norm: keystone peer review organization

Name: Keystone Peer Review Organization
norm: keystone peer review organization
Also named: Keystone Peer Review Organization, Inc.dba oflegal entity
KEPROdba oftrade name
Industry: Professional Servicesllm

Discovered: May 10, 2019
Breach occurred: Apr 1, 2019 – May 10, 2019
Undetected for: 39 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 12, 2019
Affected individuals: 3state-resident count only
Data types: PIIIdentity (basic)Government IDEmployment
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Initial access: insider_action

During the incident: Undertook an internal investigation, including conducting interviews with the temporary employee and the third-party individual
Attempting to obtain and analyze all devices on which the affected I-9 files were accessed without authorization
Evaluating how it should instruct its employees further about data handling and security concerns
Arranged with ID Experts to provide up to twelve months of credit monitoring at no charge
Changes made: Evaluating how it should instruct its employees further about data handling and security concerns
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(33 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Data-Breach-Notification-2.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 12, 2019
Raw hash: c6dd8007899082f8c0548ccc115ecfe8cbab03ed5907566f0c99a3fc768eb9db

Reporting entityKeystone Peer Review Organization

Victim entityKeystone Peer Review Organization

Incidentdiscovered May 10, 2019

Stated responseUndertook an internal investigation, including conducting interviews with the temporary employee and the third-party individual

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov