HackingTechnologyTelecom & MediaInformationStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPIIMediumContained

CoastAlaska, Inc. (KTOO)

bd_c2265b470c0cc5a4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 12, 2021

Filed

Mar 10, 2021

To disclose

26 days

Affected

2state residents only

Confidence

65%

Full breach record for CoastAlaska, Inc. (KTOO) →

CoastAlaska, Inc. (KTOO) notified Montana residents that an unauthorized actor accessed the email account of its Finance Director on February 12, 2021. The actor had access to emails dating back to July 2014, potentially exposing names, SSNs, addresses, and passport numbers. CoastAlaska secured the account, engaged legal counsel, reported to the FBI, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2418 days

discovery → filing · 26 days

Jul 1, 2014

Begins

Feb 12, 2021

Discovered

Mar 10, 2021

Filed

vs. sector median

15 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: CoastAlaska, Inc. (KTOO)
norm: coastalaska inc ktoo
Domain: coastalaska.org

Name: CoastAlaska, Inc. (KTOO)
norm: coastalaska inc ktoo
Domain: coastalaska.org
Industry: TechnologyllmTelecom & Mediallm

Discovered: Feb 12, 2021
Breach occurred: Jul 1, 2014
Undetected for: 2,418 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 9, 2021
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Reported this incident to the FBI and local police
Initial access: valid_credentials

During the incident: Secured Ms. Paradis’s email account
Ensured two-factor authentication is currently activated on all email accounts
Restored deleted emails to examine for personal information
Engaged legal counsel experienced in privacy, cybersecurity, and data protection
Reported this incident to the FBI and local police
Changes made: Encrypting certain information
Taking steps to evaluate additional safeguards
Reviewing email, data, and security policies and procedures
Making appropriate revisions to better protect the security of the email system and data
Offering 12 months of credit monitoring/identity theft services at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 days(26 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/coastSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 10, 2021
Raw hash: 2eb92efa96f1a844ade3f5ce7efef04b38c3dace989a52bd6d54101ffa7c89bb

Reporting entityCoastAlaska, Inc. (KTOO)

Victim entityCoastAlaska, Inc. (KTOO)

Incidentdiscovered Feb 12, 2021

Stated responseSecured Ms. Paradis’s email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov