AccidentalProfessional ServicesProfessional ServicesMisconfigurationData ExfiltratedData PublishedDelayed DiscoveryCustomer Data InvolvedPIIIdentity (basic)Health (basic)CredentialsAuthenticationMediumContained

ClearVoiceResearch.com, LLC

bd_53b60caeddf13d03 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 17, 2021

Filed

Apr 28, 2021

To disclose

11 days

Affected

21,564state residents only

Linked

7 filings

Confidence

70%

Full breach record for ClearVoiceResearch.com, LLC →

ClearVoice Research.com, LLC notified Washington AG of a data breach involving 21,564 residents. An unauthorized user accessed a publicly exposed cloud storage container holding 2015 database backups containing PII, passwords, and health/political data. The breach was discovered on April 17, 2021, after the data was posted online. ClearVoice secured the files, forced password resets, and implemented additional security measures.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d11 days discovery → filing

Incident timeline

undetected · 2040 days

discovery → filing · 10 days

Sep 17, 2015

Begins

Apr 17, 2021

Discovered

Apr 28, 2021

Filed

vs. sector median

18 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Delaware State AGbd_0822c7ec9b5072212021-04-29 · +1dVerified
Maine State AGbd_54755467b2bdd2ea2021-04-29 · +1dVerified
California State AGbd_d036182d86085ee62021-04-29 · +1dVerified
Oregon State AGbd_030e63c4319df8fd2021-04-30 · +2dVerified

Show 2 more filings ↓up to 117d gap

Maine State AGbd_af3ffae86961502f2021-05-03 · +5dVerified
Illinois State AGbd_7f360c08f52a0cad2021-01-01 · +117dCandidate

Name: Holland & Hart LLP
norm: holland hart

Name: ClearVoiceResearch.com, LLC
norm: clearvoiceresearchcom
Domain: clearvoiceresearch.com
Industry: Professional Servicesllm

Discovered: Apr 17, 2021
Breach occurred: Sep 17, 2015 – Apr 17, 2021
Undetected for: 2,040 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 29, 2021
Affected individuals: 21,564state-resident count only
Data types: PIIIdentity (basic)Health (basic)CredentialsAuthentication
Data elements: NameDate of birthUsername + password
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage ObjectT1074 Data Staged
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Office of the Attorney General

During the incident: Secured and eliminated any further exposure to the files in the file storage service
Conducted a comprehensive search of all of our databases and files
Forced a password reset for all persons that participate in the panels/surveys and members whose information had been potentially exposed
Changed the credentials of all employees
Implemented additional security measures designed to prevent a recurrence of such an incident
Changes made: Implemented additional security measures designed to prevent a recurrence of such an incident and to protect the privacy of panel participants
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 days(11 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Washington State AG+117d · this page

Delaware State AG+118d

Maine State AG+118d

California State AG+118d

Oregon State AG+119d

Maine State AG+122d

Pattern: first filing Jan 1 (IL), last May 3 (ME) — a 122-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10451.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2021
Raw hash: ec7d74b194e4e47090203144d308a56e5ff82eb91c26e6dcd96b6889967269a7

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityHolland & Hart LLP

Victim entityClearVoiceResearch.com, LLC

Incidentdiscovered Apr 17, 2021

Stated responseSecured and eliminated any further exposure to the files in the file storage service

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com