Social EngineeringProfessional ServicesProfessional ServicesPhishingCustomer Data InvolvedPIIIdentity (basic)LowContained

Urban Resource Institute

bd_ecf4e5de659ea981 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 23, 2020

Filed

Oct 20, 2021

To disclose

15 months

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Urban Resource Institute →3 incidents on file

Urban Resource Institute notified Montana residents of a data security incident where unauthorized individuals accessed employee email accounts via phishing around July 23, 2020. Personal information may have been exposed. The organization secured accounts, hired forensic investigators, reported to the FBI, and offered free credit monitoring through IDX. Notification was sent in October 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 months / 454 days

Jul 23, 2020

Discovered

Oct 20, 2021

Filed

vs. sector median

+47 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_865f0dd9af20fbbb2021-10-21 · +1dVerified
Massachusetts State AGbd_ac5ecbf21bc45f5a2021-10-21 · +1dVerified
New Hampshire State AGbd_b08423c80cdb01412021-10-21 · +1dVerified

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: Urban Resource Institute
norm: urban resource institute
Industry: Professional Servicesllm

Discovered: Jul 23, 2020
Materiality determined: —
Notification sent: Oct 20, 2021
Affected individuals: 1state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: External
Regulator citations: Reported this matter to the Federal Bureau of Investigation (FBI)
Initial access: phishing_link

During the incident: Secured the account as well as its email environment
Began an investigation
Hired a leading, independent firm with expertise in these matters
Conducted a comprehensive review of the contents of the relevant email accounts
Reported this matter to the Federal Bureau of Investigation (FBI)
Offering credit monitoring and identity theft restoration services at no cost through IDX
Changes made: Put in place extra safeguards to help ensure the security of its email environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 months(454 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGOct 20 · first · this page

Maine State AG+1d

Massachusetts State AG+1d

New Hampshire State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-23.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 20, 2021
Raw hash: c3e79305d05ed0a701f057a28570d7d5826c0832477ab167d7e94623bb5ecce7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityUrban Resource Institute

Incidentdiscovered Jul 23, 2020

Stated responseSecured the account as well as its email environment

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov