Business ProfileforS E M A Construction

The following describes a government action that has been resolved by either a settlement or a decision by a court or administrative agency. If the matter is being appealed, it will be noted below.

On November 8, 2021, The State of Colorado through its Department of Law entered into an Assurance of Discontinuance with SEMA Construction, Inc.

The Assurance states SEMA Construction will update its data security practices and pay more than $63,000 after it failed to protect the personal information of nearly 2,000 Colorado employees and residents.

Colorado law requires companies that maintain sensitive personal information to take reasonable steps to protect information, to dispose of it when it is no longer needed, and to notify Colorado residents promptly when their information is at risk of being misused by unauthorized third parties.

SEMA violated Colorado data security laws when it failed to maintain reasonable security practices and notify Colorado residents of a 2018 data breach in a timely manner.

When SEMA was the target of a phishing attack in October 2018, the company did not have a data disposal policy. SEMA employees had stored personal information, such as Social Security numbers, bank account or routing numbers, and driver’s license numbers, in their employee email accounts for as long as 20 years. The company failed to account for this risky practice and did not take a comprehensive approach to information security, as it should have, given its size and the nature of the information it maintained.

When SEMA discovered the phishing attack impacted employees’ email accounts nearly a year later, the company was unprepared to notify impacted Coloradans of the breach. Although the company learned of the breach in 2019, SEMA didn’t notify some employees of the breach until Oct. 1, 2020. Other employees weren’t notified until December 30, 2020, over two years after the company discovered the phishing attack.

In the settlement, the company agreed to update its security practices by maintaining an incident response plan, an information security plan, and an information disposal policy. SEMA will also submit reports to the Department of Law to ensure it complies with Colorado law to protect personal information of its clients and employees in the future.

For more information, please contact the State of Colorado Department of Law athttps://coag.gov/ or (720) 508-6000.