DisclosureLens
Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)MediumContained

Montana Self-Insurers Guaranty Fund

bd_0008a64f1ef573df · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 24, 2019

Filed

Jan 15, 2020

To disclose

34 weeks

Affected

Not disclosed

Confidence

65%

Equian, LLC notified the Montana Self-Insurers Guaranty Fund that an employee email account was compromised via phishing on May 24, 2019. Although the attacker attempted social engineering, Equian states there is no evidence the unauthorized party viewed or collected personal information. However, customer PII (names, SSNs, medical/health insurance info, addresses) was present in the compromised emails. Equian reset passwords and engaged forensic investigators. Notices were sent to affected individuals in December 2019 offering credit monitoring.

Incident timeline

discovery → filing · 34 weeks / 236 days

May 24, 2019

Begins

May 24, 2019

Discovered

Jan 15, 2020

Filed

vs. sector median

+25 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.