HackingProfessional ServicesProfessional ServicesPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedCredentialsFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumResolved

Wurkforce, Inc.

bd_5304feaf85409776 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 11, 2020

Filed

Aug 3, 2020

To disclose

25 weeks

Affected

527state residents only

Linked

7 filings

Confidence

69%

Full breach record for Wurkforce, Inc. →

Würkforce, Inc. notified Washington AG of a cyberattack where employee email accounts were accessed without authorization between Nov 22, 2019 and Feb 12, 2020. The breach was discovered on Feb 11, 2020. PII including SSNs, driver's licenses, financial data, and health info was exposed for 527 Washington residents. Notices were sent Aug 3, 2020.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d25 weeks discovery → filing

Incident timeline

undetected · 81 days

discovery → filing · 25 weeks / 174 days

Nov 22, 2019

Begins

Feb 11, 2020

Discovered

Aug 3, 2020

Filed

vs. sector median

+5 wks slower

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_18f0dff354c8b3842020-08-03Verified
Oregon State AGbd_3a96e56e76927b842020-08-03Candidate
Indiana State AGbd_7e0d5e2688fff7222020-08-03Verified
Montana State AGbd_921460ad57981f4c2020-08-03Verified by operator

Show 2 more filings ↓

Massachusetts State AGbd_98a758c17a0664372020-08-03Verified
New Hampshire State AGbd_9ebd1e3626d41f482020-08-03Verified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Wurkforce, Inc.
norm: wurkforce
Industry: Professional Servicesllm

Discovered: Feb 11, 2020
Breach occurred: Nov 22, 2019 – Feb 12, 2020
Undetected for: 81 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2020
Affected individuals: 527state-resident count only
Data types: CredentialsFinancial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance ID
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 200-299dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to law enforcement
Initial access: phishing_link

During the incident: Engaged an independent digital forensics firm to conduct an investigation
Engaged a document review vendor to assist in reviewing the contents of the relevant accounts
Reported the incident to law enforcement
Notified law enforcement of this incident
Took steps to enhance the security of its email system
Providing complimentary credit monitoring and identity theft restoration services
Changes made: Working with leading cybersecurity experts to enhance the security of its digital environment
Enhanced the security of its email system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(174 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

California State AGAug 3 · first

Oregon State AGAug 3 · first

Indiana State AGAug 3 · first

Montana State AGAug 3 · first

Massachusetts State AGAug 3 · first

New Hampshire State AGAug 3 · first

Washington State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10209.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2020
Raw hash: 141590be05932bab4f4f5bb8226acdfd4b0df57f559873fc1f7663865633511e

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityWurkforce, Inc.

Incidentdiscovered Feb 11, 2020

Stated responseEngaged an independent digital forensics firm to conduct an investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com