MalwareFinancial ServicesFinanceRansomwareData ExfiltratedData EncryptedDelayed DiscoveryPIIIdentity (basic)LowContained

CONTINENTAL CASUALTY COMPANY

bd_5a60d99cfc68d2f6 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 17, 2021

To disclose

—

Affected

57state residents only

Confidence

64%

Full breach record for CONTINENTAL CASUALTY COMPANY →2 incidents on file

Arthur J. Gallagher & Co. notified South Carolina and other state attorneys general of a ransomware incident detected on September 26, 2020. The attack occurred between June 3 and September 26, 2020, resulting in the encryption of systems and unauthorized access to certain network segments. Gallagher took systems offline, engaged forensic specialists, and notified law enforcement. The breach impacted individuals' personal information, for which 24 months of credit monitoring via Kroll was provided. Notification letters were issued starting May 24, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 3, 2020

Begins

Aug 17, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed57 affectedView incident

Name: ARTHUR J. GALLAGHER & CO.
norm: arthur j gallagher

Name: CONTINENTAL CASUALTY COMPANY
norm: continental casualty
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jun 3, 2020 – Sep 26, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 57state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: reported this incident to law enforcement and regulatory authorities

During the incident: Took all our systems offline as a precautionary measure
Initiated response protocols
Launched an investigation with the assistance of third-party cybersecurity and forensic specialists
Implemented our business continuity plans
Reported this incident to law enforcement and regulatory authorities
Providing you access, at no cost, to identity and credit monitoring services for twenty-four months through Kroll
Changes made: Reviewed existing security policies
Implemented additional measures and enhanced security tools
Implemented additional safeguards
Providing additional training to our employees on data privacy and security
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/ContinentalCasualtyCompany.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2021
Raw hash: 394b4d4e160f01d5329ee8ebff5cda7ae58bf3f578aab4f4e50ff03449a4eaeb

Reporting entityARTHUR J. GALLAGHER & CO.

Victim entityCONTINENTAL CASUALTY COMPANY

IncidentRansomware

Stated responseTook all our systems offline as a precautionary measure

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov