AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Anderson & Murison, Inc.

bd_1641c92cd8c1fd97 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 18, 2014

Filed

Aug 7, 2014

To disclose

20 days

Affected

23state residents only

Linked

2 filings

Confidence

66%

Full breach record for Anderson & Murison, Inc. →2 incidents on file

Anderson & Murison, Inc., a wholesale insurance broker, disclosed a data event affecting 23 New Hampshire residents. Between June 2014 and July 18, 2014, personal umbrella applications containing names, addresses, DOBs, and driver's licenses were inadvertently accessible on the internet due to a firewall misconfiguration. The breach was discovered on July 18, 2014. Notifications were sent on August 7, 2014, offering 1 year of Kroll identity theft protection.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 47 days

discovery → filing · 20 days

Jun 1, 2014

Begins

Jul 18, 2014

Discovered

Aug 7, 2014

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_142524a26006be842014-08-07Candidate

Name: Anderson & Murison, Inc.
norm: anderson murison
Domain: andersonmurison.com

Name: Anderson & Murison, Inc.
norm: anderson murison
Domain: andersonmurison.com
Industry: Financial Servicesllm

Discovered: Jul 18, 2014
Breach occurred: Jun 1, 2014 – Jul 18, 2014
Undetected for: 47 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 7, 2014
Affected individuals: 23state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified law enforcementNotified the New Hampshire Insurance Department

During the incident: Access was terminated
Worked with an outside IT expert to remove the information from the internet
Passwords and authentication credentials were changed
Notified law enforcement
Notified the New Hampshire Insurance Department
Secured the services of Kroll to provide identity theft protection
Changes made: Taking significant steps to improve its online rating security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGAug 7 · first

New Hampshire State AGAug 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/anderson-murison-20140807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 7, 2014
Raw hash: d23de4c4c73c57b8223ee140cefdb87755da1d40478aea76f87fef38479c52ab

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAnderson & Murison, Inc.

Victim entityAnderson & Murison, Inc.

Incidentdiscovered Jul 18, 2014

Stated responseAccess was terminated

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov