HackingIdentity (basic)Government IDPHIMediumContained

Kern Oil & Refining Co.

bd_ec242e430750fd62 · schema v1 · pii pii-v2

Severity

Medium

Discovered

Aug 1, 2025

Filed

Nov 12, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

67%

Full breach record for Kern Oil & Refining Co. →

Kern Oil and Refining Inc. (dba Kern Energy) notified Nebraska residents of a security incident in August 2025 where an unauthorized third party gained access to systems containing personal information of current and former employees, dependents, and beneficiaries. Data potentially impacted includes names, addresses, SSNs, and health insurance info. Kern engaged forensic experts, notified law enforcement, and strengthened security measures. No evidence of actual data misuse was found. Affected individuals were offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 1, 2025

Discovered

Nov 12, 2025

Filed

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_e312f6f33b2643a72025-11-12Verified
New Hampshire State AGbd_cac7e6b0439a559d2025-11-21 · +9dVerified
California State AGbd_27210e2d0ad775112025-11-24 · +12dCandidate

Name: Kern Oil & Refining Co.
norm: kern oil refining

Name: Kern Oil & Refining Co.
norm: kern oil refining
Also named: Kern Oil and Refining Incdba oflegal entity
Kern Energydba oftrade name

Discovered: Aug 1, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Engaged third-party forensic experts to assist with response and remediation efforts
Notified law enforcement of the incident
Changes made: Reviewed our technical and administrative security measures and taken steps to further strengthen those measures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGNov 12 · first

Nebraska State AGNov 12 · first · this page

New Hampshire State AG+9d

California State AG+12d

Pattern: first filing Nov 12 (IN), last Nov 24 (CA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/f58a56f5-644e-4c89-b0ad-63bc5f032e01.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2025
Raw hash: d352c3d0b2e981bebcd4edc754fc6640dea9c0e1550dda1152381886e11409db

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKern Oil & Refining Co.

Victim entityKern Oil & Refining Co.

Incidentdiscovered Aug 1, 2025

Stated responseEngaged third-party forensic experts to assist with response and remediation efforts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov