MalwareManufacturingManufacturingRansomwareData EncryptedRansom DemandedGovernment IDIdentity (basic)MediumContained

Burrow

bd_c43913761915dcc2 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Sep 22, 2025

Filed

Jan 27, 2026

To disclose

—

Affected

Not disclosed

Confidence

67%

Full breach record for Burrow →

Burrow Construction Inc experienced a ransomware attack discovered on September 22, 2025. The incident involved data encryption and ransom demands. The company determined on December 30, 2025, that personal information, including names and Social Security Numbers or ITINs, may have been accessed. Burrow reported the incident to law enforcement, engaged Kroll for forensic investigation and identity monitoring services, and implemented additional security controls.

J jump to incidentP pin to compareR raw source

Incident timeline

Sep 22, 2025

Discovered

Jan 27, 2026

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Burrow
norm: burrow
Domain: burrows-supply.com

Name: Burrow
norm: burrow
Domain: burrows-supply.com
Industry: Manufacturingllm

Discovered: Sep 22, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: reported this incident to law enforcement

During the incident: Investigated the incident
Blocked further unauthorized activity
Took steps to terminate the third party’s access
Reported this incident to law enforcement
Cooperating with their investigation
Terminated the unauthorized access upon discovery
Worked with cybersecurity experts to investigate and remediate the incident
Implemented additional security controls
Secured Kroll’s services to provide identity monitoring
Changes made: Implemented additional security controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/567fe186-80ad-4199-b300-86bd64239563.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 27, 2026
Raw hash: be36b4ee3efee7cb668da9158ce9c519e7153e6f0bdfbdd29308fd8e268c1b7e

Reporting entityBurrow

Victim entityBurrow

Incidentdiscovered Sep 22, 2025

Stated responseInvestigated the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov