HackingConstructionConstructionSupply Chain (3P Vendor)Employee Data InvolvedCustomer Data InvolvedGovernment IDIdentity (basic)Financial accountEmploymentMediumActive

Whiting-Turner Contracting Company

bd_6fa25983a274368a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 8, 2016

Filed

Apr 6, 2016

To disclose

29 days

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Whiting-Turner Contracting Company →

Whiting-Turner Contracting Company notified the California AG of a data security incident involving an outside tax filing vendor. On March 8, 2016, the vendor detected suspicious activity. The incident potentially affected employees' W-2 data (SSN, wages) and dependents' 1095 data (SSN, DOB). The company shut down access to the vendor's systems, notified the FBI and IRS, and offered credit/identity monitoring. The investigation was ongoing at the time of notice.

J jump to incidentP pin to compareR raw source

California clockDiscovered Mar 8, 2016 → Notified Apr 5, 201628d ✓ CA 60-day OK29 days discovery → filing

Incident timeline

discovery → filing · 29 days

Mar 8, 2016

Begins

Mar 8, 2016

Discovered

Apr 6, 2016

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_2c42d96ebd9d06962016-04-06Verified
Montana State AGbd_965115db0713961f2016-04-06Candidate
Massachusetts State AGbd_56b82c9be973171c2016-04-11 · +5dVerified

Name: Whiting-Turner Contracting Company
norm: whiting turner contracting
Domain: whiting-turner.com

Name: Whiting-Turner Contracting Company
norm: whiting turner contracting
Domain: whiting-turner.com
Industry: Constructionllm

Discovered: Mar 8, 2016
Breach occurred: Mar 8, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2016
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountEmployment
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the IRSNotified certain state regulators
Third party: via Outside vendor for tax filing and information services
Initial access: supply_chain

During the incident: Immediately shut down the ability for users to access the information on the outside vendor’s systems
Began an investigation to determine whether any Whiting-Turner employee information was accessed by an unauthorized individual
Notified the FBI, IRS, and certain state regulators
Offering one year of identity monitoring and identity theft protection services through Identity Guard for Kids to parents/guardians of affected minor dependents
Offering one year of credit monitoring and identity theft protection services with Identity Guard to affected employees and adult beneficiaries
Changes made: Taking steps to prevent an incident like this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: CA 60-day OK · 28d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Mar 8, 2016
→ Notified: Apr 5, 2016
28d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Mar 8, 2016 → Notified: Apr 5, 2016	28d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGApr 6 · first

Montana State AGApr 6 · first

California State AGApr 6 · first · this page

Massachusetts State AG+5d

Pattern: first filing Apr 6 (NH), last Apr 11 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-60875
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2016
Raw hash: 81ec4934bd2a0e87464a149fae656d230f9f002e41f1eee7fe7136822ca0a1a4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWhiting-Turner Contracting Company

Victim entityWhiting-Turner Contracting Company

Incidentdiscovered Mar 8, 2016

Stated responseImmediately shut down the ability for users to access the information on the outside vendor’s systems

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov