The Colorado Office of the Attorney General announced SEMA Construction agreed to pay more than $63,000 after a data breach. In 2018, a phishing attack at the company exposed the personal information of nearly 2,000 individuals. The personal information, including Social Security numbers and financial information, was improperly stored in employee emails. While the company learned of the breach in 2019, it did not notify employees until 2020. Additionally, SEMA must update its security practices.