HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Metromile Insurance Company
bd_437eec22c74c3cd3 · schema v1 · pii pii-v1
Full breach record for Metromile Insurance Company →Metromile Insurance Company reported a data breach affecting California residents. Unknown actors exploited the online quote form and application process between July 2020 and January 2021 to obtain personal information, including driver's license numbers. Metromile engaged forensic investigators, notified law enforcement, and offered two years of complimentary identity protection and credit monitoring services.
California clockDiscovered Jan 1, 2021 → Notified Mar 5, 202163d ✗ CA 60-day late9 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_be40199aebc5a1d5Oregon State AGfiled 2021-03-06Verified
- bd_ff07db480409627bWashington State AGfiled 2021-03-05(1d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-538935
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 6, 2021
- Raw hash
- fdc074bc7d40b62d86da1e1e31b77eea1b2b161b4fdaed183d20e5e14abb00a6
Reporting entity
- Name
- Metromile Insurance Companynorm: metromile insurance
Victim entity
- Name
- Metromile Insurance Companynorm: metromile insurance
Incident
- Discovered
- Jan 1, 2021
- Materiality determined
- —
- Notification sent
- Mar 5, 2021
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(64 days from discovery to filing)
- Compliance flags
- CA 60-day late · 63d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jan 1, 2021→ Notified: Mar 5, 202163d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.