AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Vertafore

bd_46b0579fff296ea1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Aug 9, 2021

To disclose

36 weeks

Affected

2state residents only

Linked

5 filings

Confidence

66%

Full breach record for Vertafore →

Vertafore disclosed a configuration error in its QQCatalyst insurance agency management product discovered on November 30, 2020. The error resulted in unauthorized public access to reports, forms, and potentially insurance applications containing names, addresses, birth dates, and driver's license numbers. Vertafore fixed the error, engaged forensic investigators, notified law enforcement, and offered one year of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 36 weeks / 252 days

Nov 30, 2020

Discovered

Aug 9, 2021

Filed

vs. sector median

+17 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_e05b9e1eb99587362021-07-09 · +31dVerified
South Carolina State AGbd_8c3393904c1de7c72021-07-08 · +32dVerified
New Hampshire State AGbd_b417a50418164b432021-09-23 · +45dVerified
Montana State AGbd_0b6fb2d524526bb72021-06-16 · +54dCandidate

Name: Vertafore
norm: vertafore

Name: Vertafore
norm: vertafore
Industry: Technologyllm

Discovered: Nov 30, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Reported the matter to U.S. federal law enforcement

During the incident: Fixed the configuration error and secured the potentially affected files
Engaged a leading security firm to search for evidence indicating potential misuse of the information
Reported the matter to U.S. federal law enforcement
Offering one year of free identity monitoring services
Changes made: Working to further enhance security tools, policies, and procedures
Enhancing security governance and staffing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 36 weeks(252 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Montana State AGJun 16 · first

South Carolina State AG+22d

New Hampshire State AG+23d

Montana State AG+54d · this page

New Hampshire State AG+99d

Pattern: first filing Jun 16 (MT), last Sep 23 (NH) — a 99-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/notificationLetter-34.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 9, 2021
Raw hash: c8f2bc253b7413329da3682e1abac43b72f4501f208ea29e7cc304f623589ca5

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityVertafore

Victim entityVertafore

Incidentdiscovered Nov 30, 2020

Stated responseFixed the configuration error and secured the potentially affected files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov