MalwareManufacturingManufacturingRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighResolved

Hoffman Construction

bd_7b522299d1fb55dd · schema v1 · pii pii-v1

Severity

High

Discovered

Aug 3, 2020

Filed

Nov 9, 2021

To disclose

15 months

Affected

3,078state residents only

Linked

3 filings

Confidence

71%

Full breach record for Hoffman Construction →2 incidents on file

Hoffman Construction Company experienced a ransomware incident between July 31 and August 4, 2020, discovered on August 3, 2020. Systems were encrypted, and files were exfiltrated. The breach affected 3,078 Washington residents, exposing names, SSNs, financial account info, medical info, and DOBs. Hoffman engaged forensic investigators, secured the network, and provided one year of credit monitoring via Experian to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d15 months discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 3 days

discovery → filing · 15 months / 463 days

Jul 31, 2020

Begins

Aug 3, 2020

Discovered

Nov 9, 2021

Filed

vs. sector median

+55 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_5f449c71e4d9a9702021-11-09Candidate
Massachusetts State AGbd_c9a7ed2f0d07cdc72021-11-09Verified

Name: Hoffman Construction
norm: hoffman construction
Domain: hoffmancorp.com

Name: Hoffman Construction
norm: hoffman construction
Domain: hoffmancorp.com
Industry: Manufacturingllm

Discovered: Aug 3, 2020
Breach occurred: Jul 31, 2020 – Aug 4, 2020
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 9, 2021
Affected individuals: 3,078state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial

During the incident: Disabled affected systems
Took steps to secure its network and restore normal business operations
Engaged a computer forensics firm
Issued a substitute notice on February 12, 2021, by posting a statement to its website and issuing a press release
Notified remaining involved Washington residents via First-Class US Mail
Offered a complimentary, one-year membership to credit monitoring and identity protection services through Experian
Established a dedicated, toll-free call center
Changes made: Implemented additional safeguards and technical security measures to further enhance the security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(463 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGNov 9 · first

Massachusetts State AGNov 9 · first

Washington State AGNov 9 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3160.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 9, 2021
Raw hash: 134e26ebc734bb4df918bb9d729e394e0365cb849c0b67207efc6128f49f9800

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityHoffman Construction

Victim entityHoffman Construction

Incidentdiscovered Aug 3, 2020

Stated responseDisabled affected systems

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com