HackingIdentity (basic)Government IDMediumContained

Pacific Railway Enterprises

bd_9fac966497b97a65 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Nov 13, 2025

Filed

Dec 29, 2025

To disclose

—

Affected

6state residents only

Linked

3 filings

Confidence

66%

Full breach record for Pacific Railway Enterprises →

Pacific Railway Enterprises, a railroad design firm, notified the Nebraska Attorney General of a data incident affecting 6 Nebraska residents. Unauthorized access occurred between Nov 13-23, 2025, resulting in the exfiltration of names and Social Security numbers. PRE offered 12 months of credit monitoring and reported the incident to federal law enforcement.

J jump to incidentP pin to compareR raw source

Leak gap clock⏱ Leak >30d

Incident timeline

Nov 13, 2025

Begins

Nov 13, 2025

Discovered

Dec 29, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

A leak claim by akira about this victim predates this filing by 33 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteakirabd_d9f20cdc88de9ea12025-11-26 · +33dVerified by operator

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_35aa4aa5e77035e42025-12-30 · +1dCandidate

Name: Kennedys CMK LLP
norm: kennedys cmk

Name: Pacific Railway Enterprises
norm: pacific railway
Domain: pacrail.com

Discovered: Nov 13, 2025
Breach occurred: Nov 13, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 29, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Nebraska Attorney GeneralReporting to other state regulators as required

During the incident: Took steps to secure its environment
Partnered with professionals to investigate and understand the nature and scope of the disruption
Reported this incident to federal law enforcement
Provided written notice of the incident to potentially impacted individuals
Offering 12 months of single bureau credit monitoring, fraud consultation, and identity theft restoration services through Cyberscout
Changes made: Reviewing its existing security policies and protections previously in place on its network
Adopting additional security to safeguard against evolving threats moving forward
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Nebraska State AGDec 29 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/af6e20da-182d-4456-a5d6-d12242367a26.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 29, 2025
Raw hash: af6c6cf070fdab08e456a14adbb4d916e32dc0daf35a29a8cbf23b50b938ac45

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityKennedys CMK LLP

Victim entityPacific Railway Enterprises

Incidentdiscovered Nov 13, 2025

Stated responseTook steps to secure its environment

ComplianceLeak >30d

Extraction provenanceno artifact recorded

Source provenancenebraska.gov