Social EngineeringGovernmentGovernmentPhishingEmployee Data InvolvedPIILowActive

Idaho Transportation Department

bd_75864a3ee9442b19 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 19, 2025

Filed

Feb 25, 2025

To disclose

6 days

Affected

Not disclosed

Confidence

64%

Full breach record for Idaho Transportation Department →2 incidents on file

Idaho Transportation Department notified the Idaho Attorney General on Feb 25, 2025, of a cybersecurity incident involving suspicious activity on an employee's email and OneDrive account. The incident occurred between Feb 17-19, 2025. The department is investigating potential PII exposure and email attachments.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 6 days

Feb 17, 2025

Begins

Feb 19, 2025

Discovered

Feb 25, 2025

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Idaho Transportation Department
norm: idaho transportation department

Name: Idaho Transportation Department
norm: idaho transportation department
Industry: Governmentllm

Discovered: Feb 19, 2025
Breach occurred: Feb 17, 2025 – Feb 19, 2025
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 25, 2025
Affected individuals: Not disclosed
Data types: PIICredentials
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: inform the Office of the Attorney General
Initial access: phishing_link

During the incident: Working with the cybersecurity team at ITS
Working with our in-house IT team to determine the types of data that was accessed
Research on the attachments in emails that were viewed
Scans are continuing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2025/02/02.25.2025-Idaho-Transportation-Department.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 25, 2025
Raw hash: 5d90f684c3e897bf9f1b7c223f493d36118f8507b5e96334b6a623b7e29896e7

Reporting entityIdaho Transportation Department

Victim entityIdaho Transportation Department

Incidentdiscovered Feb 19, 2025

Stated responseWorking with the cybersecurity team at ITS

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov