HackingPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
HiRoad
bd_2c56a56d9a8d758d · schema v1 · pii pii-v1
Full breach record for HiRoad →HiRoad Automobile Insurance notified Massachusetts regulators of a cybersecurity incident involving unauthorized access to its systems. The breach occurred between December 22, 2025, and January 15, 2026, and was discovered on January 23, 2026. An unauthorized actor accessed and acquired information, potentially including customer PII and government IDs. The incident involved third-party provider Navia.
Massachusetts clock✗ MA AG >90d18 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-917-hiroad-automobile-insurance/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 1, 2026
- Raw hash
- 8daddab4997d53310a5963dcf216dd66cd899d4e1c0a8dcb2f6f77fdc5f546db
Reporting entity
- Name
- HiRoad Automobile Insurancenorm: hiroad automobile insurance
Victim entity
- Name
- HiRoadnorm: hiroad
- Domain
- quote.hiroad.com
Incident
- Discovered
- Jan 23, 2026
- Materiality determined
- Feb 26, 2026
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Filed breach notification with Massachusetts Department of Public Safety
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 18 weeks(129 days from discovery to filing)
- Compliance flags
- MA AG >90d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.