AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Anderson & Murison, Inc.

bd_142524a26006be84 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 18, 2014

Filed

Aug 7, 2014

To disclose

20 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Anderson & Murison, Inc. →2 incidents on file

Anderson & Murison, Inc., a wholesale insurance broker, disclosed an inadvertent exposure of personal information due to a web-based rating system misconfiguration. Between June 1, 2014, and July 18, 2014, umbrella applications containing names, addresses, dates of birth, and driver's license numbers were accessible on the internet. The company discovered the issue on July 18, 2014, immediately changed server credentials, and offered one year of identity theft protection via Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 47 days

discovery → filing · 20 days

Jun 1, 2014

Begins

Jul 18, 2014

Discovered

Aug 7, 2014

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_1641c92cd8c1fd972014-08-07Verified

Name: Anderson & Murison, Inc.
norm: anderson murison

Name: Anderson & Murison, Inc.
norm: anderson murison
Industry: Financial Servicesllm

Discovered: Jul 18, 2014
Breach occurred: Jun 1, 2014 – Jul 18, 2014
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Misconfiguration
Regulator citations: Reported the breach to law enforcementReported the breach to the California Attorney General’s Office
Initial access: exploit_public_facing

During the incident: Changed the involved server’s authentication passwords and credentials for the affected accounts
Reported the breach to law enforcement
Reported the breach to the California Attorney General’s Office
Secured the services of Kroll to provide identity theft protection at no cost for 1 year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGAug 7 · first

California State AGAug 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-46150
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2014
Raw hash: 4cb43b1cc564da7a0e5e53296066ca4fd8a2a8c57fa636ca38e0ea4ab3276d3a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAnderson & Murison, Inc.

Victim entityAnderson & Murison, Inc.

Incidentdiscovered Jul 18, 2014

Stated responseChanged the involved server’s authentication passwords and credentials for the affected accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov