AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedFinancialHealth (basic)Identity (basic)Government IDPHIMediumContained

BackNine Insurance and Financial Services, Inc.

bd_4ce68e7cc28dddcf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 12, 2021

Filed

Aug 17, 2021

To disclose

5 weeks

Affected

866state residents only

Linked

8 filings

Confidence

69%

Full breach record for BackNine Insurance and Financial Services, Inc. →

BackNine Insurance and Financial Services, Inc. notified Washington AG of a data security incident on August 17, 2021. A coding error caused insurance and annuity applications containing PII, PHI, and financial data to be uploaded to a publicly accessible cloud storage container on July 12, 2021. 866 Washington residents were notified on August 13, 2021. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d5 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

discovery → filing · 5 weeks / 36 days

Jul 12, 2021

Discovered

Aug 17, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Oregon State AGbd_bf4eff08713081142021-08-17Verified
California State AGbd_f6266be19daceb2c2021-08-17Verified
Massachusetts State AGbd_9240e3f3f800e2792021-08-18 · +1dVerified
Maine State AGbd_a3139dfc8b843b512021-08-18 · +1dVerified

Show 3 more filings ↓up to 228d gap

Indiana State AGbd_d878c5fd1831b3002021-08-13 · +4dVerified
Montana State AGbd_04b76c0a63bd345d2021-08-12 · +5dVerified
Illinois State AGbd_85596477ba14fd2e2021-01-01 · +228dCandidate

Name: Lewis Brisbois Bisgaard & Smith, PLLC
norm: lewis brisbois bisgaard smith

Name: BackNine Insurance and Financial Services, Inc.
norm: backnine insurance and financial
Industry: Financial Servicesllm

Discovered: Jul 12, 2021
Materiality determined: —
Notification sent: Aug 13, 2021
Affected individuals: 866state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial
Data elements: NameSocial Security numberDriver's licence numberDate of birthMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Notified Washington Office of the Attorney General

During the incident: Immediately changed the settings applicable to the relevant cloud storage container so that the cloud storage container at issue was no longer publicly accessible
Audited all other cloud storage containers to ensure that it was the only one affected
Altered the misconfigured code to ensure that insurance and annuity applications would no longer be inadvertently uploaded to a publicly accessible container
With the assistance of outside data privacy and cybersecurity experts—conducted an investigation
Changes made: Altered the misconfigured code to ensure that future applications would be uploaded to and stored in the intended, non-publicly accessible folders
Implementing additional security measures to protect the information on our systems and to minimize the likelihood of a similar situation occurring in the future
Offering free identity protection services for 12 or 24 months through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+223d

Indiana State AG+224d

Oregon State AG+228d

California State AG+228d

Washington State AG+228d · this page

Massachusetts State AG+229d

Maine State AG+229d

Pattern: first filing Jan 1 (IL), last Aug 18 (ME) — a 229-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10807.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2021
Raw hash: 04214c55056b27afd8d4c0d73c51c5b55e9c7a74169daf857d67ab9e6759cc03

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityLewis Brisbois Bisgaard & Smith, PLLC

Victim entityBackNine Insurance and Financial Services, Inc.

Incidentdiscovered Jul 12, 2021

Stated responseImmediately changed the settings applicable to the relevant cloud storage container so that the cloud storage container at issue was no longer publicly accessible

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com