HackingProfessional ServicesProfessional ServicesStolen CredentialsPhishingSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedMulti-Stage ChainIdentity (basic)Government IDFinancialMediumActive

Whiting-Turner Contracting Company

bd_965115db0713961f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 8, 2016

Filed

Apr 6, 2016

To disclose

29 days

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Whiting-Turner Contracting Company →

Whiting-Turner Contracting Company notified employees and dependents of a data security incident involving a third-party tax filing vendor. The vendor detected suspicious activity on March 8, 2016, leading to reports of fraudulent tax filings. Potentially affected data includes names, SSNs, DOBs, and wage information from 2015 W-2 and 1095 forms. Whiting-Turner shut down vendor access, notified the FBI and IRS, and offered one year of credit monitoring/identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 days

Mar 8, 2016

Discovered

Apr 6, 2016

Filed

vs. sector median

15 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_2c42d96ebd9d06962016-04-06Verified
California State AGbd_6fa25983a274368a2016-04-06Verified
Massachusetts State AGbd_56b82c9be973171c2016-04-11 · +5dVerified

Name: Whiting-Turner Contracting Company
norm: whiting turner contracting
Domain: whiting-turner.com

Name: Whiting-Turner Contracting Company
norm: whiting turner contracting
Domain: whiting-turner.com
Industry: Professional Servicesllm

Discovered: Mar 8, 2016
Materiality determined: —
Notification sent: Apr 5, 2016
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified the FBINotified the IRSNotified certain state regulators
Initial access: supply_chain

During the incident: Shut down the ability for users to access the information on the outside vendor’s systems
Began an investigation to determine whether any Whiting-Turner employee information was accessed
Notified the FBI, IRS, and certain state regulators
Offering the parent/guardian of all potentially affected minor dependents access to one year of identity monitoring and identity theft protection services through Identity Guard ® for Kids
Offering all potentially affected individuals access to one year of credit monitoring and identity theft protection services with Identity Guard ®
Changes made: Taking steps to prevent an incident like this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGApr 6 · first

California State AGApr 6 · first

Montana State AGApr 6 · first · this page

Massachusetts State AG+5d

Pattern: first filing Apr 6 (NH), last Apr 11 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Whiting-Turner-Contracting-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 6, 2016
Raw hash: ff4214beaba30d91eb1ea89bd153040d61beba0cdf85fec006ac73bbd7c53b16

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityWhiting-Turner Contracting Company

Victim entityWhiting-Turner Contracting Company

Incidentdiscovered Mar 8, 2016

Stated responseShut down the ability for users to access the information on the outside vendor’s systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov