HackingEnergy & UtilitiesUtilitiesStolen CredentialsData ExfiltratedGovernment IDIdentity (basic)MediumContained

Clipper Petroleum

bd_8604e198c5fc339f · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 6, 2026

Filed

Feb 18, 2026

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Clipper Petroleum →

Clipper Petroleum Inc reported unauthorized access to its computer network on December 8, 2025. The breach resulted in the exfiltration of one Nebraska resident's name and Social Security Number. Clipper discovered the incident on January 6, 2026, and mailed notification on February 18, 2026, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

Dec 8, 2025

Begins

Jan 6, 2026

Discovered

Feb 18, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_4760be258bca622e2026-01-21 · +28dCandidate

Name: Clipper Petroleum
norm: clipper petroleum
Domain: clipperpetroleum.com

Name: Clipper Petroleum
norm: clipper petroleum
Domain: clipperpetroleum.com
Industry: Energy & Utilitiesllm

Discovered: Jan 6, 2026
Breach occurred: Dec 8, 2025
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 18, 2026
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to secure its network
Commenced an investigation
Engaged a cybersecurity firm
Mailed a notification letter via U.S. First-Class mail
Offered one year of complimentary credit monitoring and identity theft protection services
Established a toll-free call center
Changes made: Taken steps to enhance its existing security measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/3f632d95-6d6b-4ed8-801a-0493b04ab11b.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 18, 2026
Raw hash: f8b0d35feb1285551c754ea77af07c7cfb8983a6689f0d1bf19f78d5b9d74d8b

Linked disclosures

Ransomware claims (1)

Reporting entityClipper Petroleum

Victim entityClipper Petroleum

Incidentdiscovered Jan 6, 2026

Stated responseTook steps to secure its network

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov