AccidentalFinancial ServicesHealthcareFinanceMisconfigurationCustomer Data InvolvedPIIPHIIdentity (basic)Health (basic)LowContained

BackNine Insurance and Financial Services, Inc.

bd_04b76c0a63bd345d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 12, 2021

Filed

Aug 12, 2021

To disclose

4 weeks

Affected

43state residents only

Linked

8 filings

Confidence

65%

Full breach record for BackNine Insurance and Financial Services, Inc. →

BackNine Insurance and Financial Services, Inc. notified Montana residents of a data security issue discovered on July 12, 2021. A coding error caused insurance and annuity applications containing PII and PHI to be uploaded to a publicly accessible cloud storage folder. BackNine secured the folder, engaged forensic experts, and offered credit monitoring services. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 4 weeks / 31 days

Jul 12, 2021

Discovered

Aug 12, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_d878c5fd1831b3002021-08-13 · +1dVerified
Washington State AGbd_4ce68e7cc28dddcf2021-08-17 · +5dVerified
Oregon State AGbd_bf4eff08713081142021-08-17 · +5dVerified
California State AGbd_f6266be19daceb2c2021-08-17 · +5dVerified

Show 3 more filings ↓up to 223d gap

Massachusetts State AGbd_9240e3f3f800e2792021-08-18 · +6dVerified
Maine State AGbd_a3139dfc8b843b512021-08-18 · +6dVerified
Illinois State AGbd_85596477ba14fd2e2021-01-01 · +223dCandidate

Name: BackNine Insurance and Financial Services, Inc.
norm: backnine insurance and financial

Name: BackNine Insurance and Financial Services, Inc.
norm: backnine insurance and financial
Industry: Financial ServicesllmHealthcarellm

Discovered: Jul 12, 2021
Materiality determined: —
Notification sent: Aug 13, 2021
Affected individuals: 43state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged

During the incident: Secured the folder so that it was no longer publicly accessible
Audited the cloud storage system to confirm that the folder at issue was the only one affected
Altered the misconfigured code to ensure that future applications would be uploaded to and stored in the intended, non-publicly accessible folders
Engaged outside data privacy and cybersecurity experts to conduct an investigation
Offered free identity protection services for 12 or 24 months through IDX
Changes made: Implementing additional security measures to protect the information on our systems
Altered the misconfigured code to ensure that future applications would be uploaded to and stored in the intended, non-publicly accessible folders
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+223d · this page

Indiana State AG+224d

Washington State AG+228d

Oregon State AG+228d

California State AG+228d

Massachusetts State AG+229d

Maine State AG+229d

Pattern: first filing Jan 1 (IL), last Aug 18 (ME) — a 229-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-56.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 12, 2021
Raw hash: 8cb17e43d3b6650cab4ad3f8731d3e23cdfafe8a3c3b0f9c17fff69d6a0e0e6d

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityBackNine Insurance and Financial Services, Inc.

Victim entityBackNine Insurance and Financial Services, Inc.

Incidentdiscovered Jul 12, 2021

Stated responseSecured the folder so that it was no longer publicly accessible

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov