KPRS Construction Services, Inc.

In March–April 2019, KPRS Construction Services, Inc. suffered a data breach involving unauthorized access to employee email accounts, as reported by the California Office of the Attorney General on November 25, 2019. The incident exposed sensitive personal information, including names, Social Security numbers, and health insurance details of employees. The breach stemmed from compromised email credentials, allowing attackers to potentially access and exfiltrate confidential data over an extended period. While the exact number of affected individuals was not specified, the exposed data posed significant risks of identity theft, financial fraud, and misuse of health-related information. The company likely faced regulatory scrutiny under data protection laws, along with reputational damage and potential legal liabilities stemming from the failure to safeguard employee records. The breach underscored vulnerabilities in email security protocols and the broader implications of third-party access to corporate systems.

Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-184651

TPRM report: https://www.rankiteo.com/company/bergmankprs

"id": "ber1012091725",
"linkid": "bergmankprs",
"type": "Breach",
"date": "3/2019",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Construction',
                        'location': 'California, USA',
                        'name': 'KPRS Construction Services, Inc.',
                        'type': 'Private Company'}],
 'attack_vector': 'Unauthorized Access (Email Compromise)',
 'data_breach': {'data_exfiltration': 'Potential (unconfirmed)',
                 'file_types_exposed': ['Emails', 'Attachments (likely)'],
                 'personally_identifiable_information': ['Names',
                                                         'Social Security '
                                                         'Numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)']},
 'date_publicly_disclosed': '2019-11-25',
 'description': 'The California Office of the Attorney General reported that '
                'KPRS Construction Services, Inc. experienced a data breach '
                'involving unauthorized access to employee email accounts, '
                'with potential exposure of personal information from March to '
                'April 2019. The types of information that may have been '
                'affected include names, Social Security numbers, and health '
                'insurance information, among others.',
 'impact': {'data_compromised': ['Names',
                                 'Social Security Numbers',
                                 'Health Insurance Information'],
            'identity_theft_risk': 'High (PII exposed)',
            'systems_affected': ['Employee Email Accounts']},
 'initial_access_broker': {'entry_point': 'Employee Email Accounts'},
 'investigation_status': 'Disclosed (no further details)',
 'post_incident_analysis': {'root_causes': ['Unauthorized Email Access (likely '
                                            'phishing or credential theft)']},
 'references': [{'date_accessed': '2019-11-25',
                 'source': 'California Office of the Attorney General'}],
 'regulatory_compliance': {'regulations_violated': ['Potential HIPAA (if '
                                                    'health data processed)',
                                                    'California Data Breach '
                                                    'Notification Law (Civil '
                                                    'Code § 1798.29 et seq.)'],
                           'regulatory_notifications': ['California Office of '
                                                        'the Attorney '
                                                        'General']},
 'response': {'communication_strategy': 'Public Disclosure via California AG '
                                        'Office'},
 'title': 'KPRS Construction Services, Inc. Data Breach (2019)',
 'type': 'Data Breach'}