Social EngineeringEnergy & UtilitiesUtilitiesPhishingTargetedIdentity (basic)Government IDMediumContained

CRIUS ENERGY, LLC

bd_ddc27f7e1c9d2d49 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2018

Filed

May 18, 2018

To disclose

21 days

Affected

1state residents only

Confidence

66%

Full breach record for CRIUS ENERGY, LLC →

Crius Energy, LLC notified Montana residents of a data breach resulting from a phishing attack on or around January 22, 2018. The incident exposed names, dates of birth, driver's license numbers, and potentially Social Security numbers. Confirmation occurred on April 27, 2018. Affected individuals were offered 24 months of credit monitoring and identity theft recovery services through ID Experts.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 95 days

discovery → filing · 21 days

Jan 22, 2018

Begins

Apr 27, 2018

Discovered

May 18, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: CRIUS ENERGY, LLC
norm: crius energy

Name: CRIUS ENERGY, LLC
norm: crius energy
Industry: Energy & Utilitiesllm

Discovered: Apr 27, 2018
Breach occurred: Jan 22, 2018
Undetected for: 95 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 18, 2018
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Providing access to free credit monitoring for twenty-four (24) months through ID Experts
Providing MyIDCare services including 24 months of credit and CyberScan monitoring
Providing a $1,000,000 insurance reimbursement policy
Providing fully managed identity theft recovery services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Crius.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 18, 2018
Raw hash: 05f8d6c7593465ae2722de5b9b5e1b5fcfbbdd11f25956397a259e40df049cdb

Reporting entityCRIUS ENERGY, LLC

Victim entityCRIUS ENERGY, LLC

Incidentdiscovered Apr 27, 2018

Stated responseProviding access to free credit monitoring for twenty-four (24) months through ID Experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov