HackingEnergy & UtilitiesUtilitiesStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedPIIIdentity (basic)Government IDFinancial accountHealth (basic)MediumActive

INVENERGY LLC

bd_74a350c45b25754f · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 15, 2021

To disclose

—

Affected

13state residents only

Linked

5 filings

Confidence

66%

Full breach record for INVENERGY LLC →4 incidents on file

Invenergy LLC notified Montana residents of a data security incident where unauthorized parties accessed computer systems between April 21 and May 17, 2021. The breach exposed employee PII, including SSNs, financial account info, and medical information. Invenergy engaged forensic investigators, secured systems, and provided one year of Kroll identity monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

Apr 21, 2021

Begins

Jun 15, 2021

Filed

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_00e9c9bdea12f34c2021-06-15Verified
Massachusetts State AGbd_9fc6ec6fae13b4cb2021-06-15Verified
Maine State AGbd_507a01d68fdfff212021-07-06 · +21dVerified by operator
New Hampshire State AGbd_6b60b2efd2e469d02021-07-06 · +21dVerified

Name: INVENERGY LLC
norm: invenergy

Name: INVENERGY LLC
norm: invenergy
Industry: Energy & Utilitiesllm

Discovered: —
Breach occurred: Apr 21, 2021 – May 17, 2021
Materiality determined: —
Notification sent: Sep 15, 2021
Affected individuals: 13state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial accountHealth (basic)
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Secured the systems involved
Commenced an investigation with the assistance of a cybersecurity forensics firm
Arranged for Kroll to provide identity monitoring services
Retrained employees concerning data security
Changes made: Implemented additional security measures to enhance the security of our network
Retrained our employees concerning data security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 15 · first

Massachusetts State AGJun 15 · first

Montana State AGJun 15 · first · this page

Maine State AG+21d

New Hampshire State AG+21d

Pattern: first filing Jun 15 (IN), last Jul 6 (NH) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-10.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2021
Raw hash: 7adf82ac4764d25cd3708b122630b49f543e8d7b427733443fe584b711ed485a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityINVENERGY LLC

Victim entityINVENERGY LLC

IncidentUnauthorized Access

Stated responseSecured the systems involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov