HackingFinancial ServicesFinanceCustomer Data InvolvedEmployee Data InvolvedGovernment IDFinancial accountHealth (basic)PHIMediumContained

SAIF CORPORATION

bd_5c20e4602451a95f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 27, 2022

Filed

Dec 7, 2022

To disclose

6 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for SAIF CORPORATION →3 incidents on file

SAIF Corporation notified the Idaho Attorney General of a data incident occurring on October 24, 2022, where an unauthorized third party gained access to its network. The breach affected archived policyholder and claimant data, potentially exposing SSNs, financial account numbers, and medical information. No evidence of misuse was found. SAIF offered 12 months of free credit monitoring and is reviewing internal security policies.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 6 weeks / 41 days

Oct 24, 2022

Begins

Oct 27, 2022

Discovered

Dec 7, 2022

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Oregon State AGbd_3747c8fdc54390622022-12-07Candidate

Name: SAIF CORPORATION
norm: saif

Name: SAIF CORPORATION
norm: saif
Industry: Financial Servicesllm

Discovered: Oct 27, 2022
Breach occurred: Oct 24, 2022
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)Financial accountHealth (basic)PHI
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified Idaho Attorney General's Office Consumer Protection Division
Initial access: exploit_public_facing

During the incident: Provided notification to potentially affected individuals through substitute notification
Making credit monitoring and ID theft protection services available to potentially affected persons for at least 12 months at no cost
Reviewing its policies and procedures to make sure employees are reminded about best practices on data security
Changes made: Reviewing its policies and procedures to make sure employees are reminded about best practices on data security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(41 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Oregon State AGDec 7 · first

Idaho State AGDec 7 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ag.idaho.gov/content/uploads/2022/12/12-07-22-SAIF-Corporation.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 7, 2022
Raw hash: 73434d8ad25a3baa0ca25beed9f0a73c361490b9911f927af70c37624f87dba0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySAIF CORPORATION

Victim entitySAIF CORPORATION

Incidentdiscovered Oct 27, 2022

Stated responseProvided notification to potentially affected individuals through substitute notification

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceag.idaho.gov