HackingEnergy & UtilitiesUtilitiesCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIMediumContained

Kern Oil & Refining Co.

bd_cac7e6b0439a559d · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Nov 21, 2025

To disclose

—

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Kern Oil & Refining Co. →

Kern Oil & Refining Inc. (dba Kern Energy) notified the New Hampshire Attorney General of a security incident in August 2025 where an unauthorized third party gained access to systems. One NH resident was affected. No evidence of data theft was found. Kern engaged forensic experts, notified law enforcement, and provided 24 months of credit monitoring. Notices were mailed on Nov 12, 2025.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 1, 2025

Begins

Nov 21, 2025

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_27210e2d0ad775112025-11-24 · +3dCandidate
Indiana State AGbd_e312f6f33b2643a72025-11-12 · +9dVerified
Nebraska State AGbd_ec242e430750fd622025-11-12 · +9dVerified

Name: Baker Botts L.L.P.
norm: baker botts

Name: Kern Oil & Refining Co.
norm: kern oil refining
Also named: Kern Oil & Refining Inc.dba oflegal entity
Kern Energydba oftrade name
Industry: Energy & Utilitiesllm

Discovered: —
Breach occurred: Aug 1, 2025
Materiality determined: —
Notification sent: Nov 12, 2025
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General's Office
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic experts to assist with response and remediation efforts
Engaged legal counsel
Notified law enforcement of the incident
Mailed notices to potentially impacted individuals via U.S. Mail on November 12, 2025
Provision of complementary credit monitoring and identity protection services through Epiq - Privacy Solutions ID Credit Monitoring - Plus for 24 months
Changes made: Assessing and updating relevant security policies and procedures, systems, tools, and configurations
Reviewed our technical and administrative security measures and taken steps to further strengthen those measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGNov 12 · first

Nebraska State AGNov 12 · first

New Hampshire State AG+9d · this page

California State AG+12d

Pattern: first filing Nov 12 (IN), last Nov 24 (CA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kern-oil-refining-kern-energy-20251121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2025
Raw hash: 1fedaaf1b4ec6ef28ea327b1e4c3d24a4970e96efcd3fd8e61ee4e0bb4245d42

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBaker Botts L.L.P.

Victim entityKern Oil & Refining Co.

IncidentUnauthorized Access

Stated responseEngaged third-party forensic experts to assist with response and remediation efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov