Colorado reaches agreement with Colorado-based construction company that failed to protect the data of nearly 2,000 people

Nov. 8, 2021 (DENVER) — Attorney General Phil Weiser today announced Colorado-based SEMA Construction will update its data security practices and pay more than $63,000 after it failed to protect the personal information of nearly 2,000 Colorado employees and residents.

Colorado law requires companies that maintain sensitive personal information to take reasonable steps to protect information, to dispose of it when it is no longer needed, and to notify Colorado residents promptly when their information is at risk of being misused by unauthorized third parties.

“Both Coloradans and Colorado companies should know we are committed to ensuring personal information is protected,” Weiser said. “Cybercrime and identity theft threaten the wellbeing of all residents, and we must hold businesses accountable to lawfully safeguarding sensitive information.”

SEMA violated Colorado data security laws when it failed to maintain reasonable security practices and notify Colorado residents of a 2018 data breach in a timely manner.

When SEMA was the target of a phishing attack in October 2018, the company did not have a data disposal policy. SEMA employees had stored personal information, such as Social Security numbers, bank account or routing numbers, and driver’s license numbers, in their employee email accounts for as long as 20 years. The company failed to account for this risky practice and did not take a comprehensive approach to information security, as it should have, given its size and the nature of the information it maintained.

When SEMA discovered the phishing attack impacted employees’ email accounts nearly a year later, the company was unprepared to notify impacted Coloradans of the breach. Although the company learned of the breach in 2019, SEMA didn’t notify some employees of the breach until Oct. 1, 2020. Other employees weren’t notified until Dec. 30, nearly 16 months after the company discovered the phishing attack.

In the settlement, the company agreed to update its security practices by maintaining an incident response plan, an information security plan, and an information disposal policy. SEMA will also submit reports to the Department of Law to ensure it complies with Colorado law to protect personal information of its clients and employees in the future.

Click here to learn more about Colorado’s data protection laws.

###