CIC Group notified 4,500 people after a breach exposed Social Security numbers
- Organization
- CIC Group, Inc.
- Exploit
- Hacking
- Industry
- Engineering and Construction
CIC Group, a St. Louis holding company whose subsidiaries provide engineering and construction services to the energy sector, notified individuals in April 2023 that an unauthorized party had obtained confidential information the company held.
In filings with state regulators, CIC Group reported that the breach occurred on March 28, 2023. Notification letters were dated April 21, and the company filed a notice with the Texas Attorney General's Office on April 24.
According to those notices, the information involved included consumers' names, addresses and Social Security numbers. The Indiana Attorney General's 2023 breach report lists CIC Group with 4,500 people affected in total, of whom 294 were Indiana residents. The Texas filing, summarized by the law firm Console and Associates, covered 1,713 Texas residents.
CIC Group did not publicly describe how the intrusion occurred, how long the attacker had access, or what security measures were taken afterward, and no group claimed responsibility. As of the reporting date the company had begun mailing letters to everyone it had identified as affected, and no further findings from the investigation had been released.