Social EngineeringManufacturingManufacturingPhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

Orascom Constuction USA, Inc.

bd_6b38080d1a64fd82 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 4, 2020

Filed

Jun 15, 2020

To disclose

6 weeks

Affected

5state residents only

Linked

2 filings

Confidence

66%

Full breach record for Orascom Constuction USA, Inc. →

Orascom Construction USA, Inc. disclosed that two employee email accounts were compromised via phishing between Jan 15 and Feb 8, 2019. The company discovered the incident on May 4, 2020. Personal information including names, SSNs, and DOBs was accessed. The company engaged forensic investigators, contained the accounts, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 475 days

discovery → filing · 6 weeks / 42 days

Jan 15, 2019

Begins

May 4, 2020

Discovered

Jun 15, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_70c4da05ece3a67c2020-06-03 · +12dVerified

Name: Orascom Constuction USA, Inc.
norm: orascom constuction usa

Name: Orascom Constuction USA, Inc.
norm: orascom constuction usa
Industry: Manufacturingllm

Discovered: May 4, 2020
Breach occurred: Jan 15, 2019 – Feb 8, 2019
Undetected for: 475 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 5state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Commenced a prompt and thorough investigation
Contained the compromised account
Working very closely with external cybersecurity professionals
Extensive forensic investigation reviewed all email accounts
Changes made: Offering identity theft protection services through ID Experts
Offering 12 months of credit and CyberScan monitoring
Offering $1,000,000 insurance reimbursement policy
Offering fully managed ID theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJun 3 · first

Montana State AG+12d · this page

Pattern: first filing Jun 3 (IN), last Jun 15 (MT) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2020
Raw hash: a0ad0b86872289a15bee5aa4a0f3198cf0fd77854df51398451394892ec8c6d4

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityOrascom Constuction USA, Inc.

Victim entityOrascom Constuction USA, Inc.

Incidentdiscovered May 4, 2020

Stated responseCommenced a prompt and thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov