HackingTechnologyFinancial ServicesInformationData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCredentialsCriticalContained

Insurance Technologies Corporation

bd_5d437c5bde5b0669 · schema v1 · pii pii-v1

Severity

Critical

Discovered

—

Filed

Apr 29, 2021

To disclose

—

Affected

132,565state residents only

Linked

4 filings

Confidence

87%

Full breach record for Insurance Technologies Corporation →3 incidents on file

On February 27, 2021, an unauthorized third party gained access to Insurance Technologies Corporation's AgencyMatrix cloud-based agency management application and acquired personal information. Data potentially affected includes full names, Social Security numbers, driver's license numbers, dates of birth, and usernames/passwords. The incident was contained on March 4, 2021. Approximately 132,565 California residents across 38 insurance brokers were affected. ITC notified federal law enforcement and retained a forensics firm.

J jump to incidentP pin to compareR raw source

Incident timeline

Feb 27, 2021

Begins

Apr 29, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_cac0d828f1249b402021-04-29Candidate
Delaware State AGbd_87d86648fe3d26c92021-05-10 · +11dVerified
Indiana State AGbd_eb7e6a33b2b18c6e2021-05-10 · +11dVerified

Name: Insurance Technologies Corporation
norm: insurance technologies

Name: Insurance Technologies Corporation
norm: insurance technologies
Industry: TechnologyllmFinancial Servicesllm

Discovered: —
Breach occurred: Feb 27, 2021
Materiality determined: —
Notification sent: —
Affected individuals: 132,565state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1530 Data from Cloud Storage Object
Threat actor: External
Regulator citations: Notified California Attorney GeneralNotified federal law enforcement

During the incident: Immediately commenced an investigation
Contained the incident on March 4, 2021
Notified federal law enforcement
Retained an independent forensics firm to assist with the investigation and analysis of the incident
Reset all valid passwords to the AgencyMatrix application
Arranged for affected individuals to enroll in one year of complimentary credit monitoring and identity protection service through TransUnion Interactive (myTrueIdentity)
Changes made: Implemented additional security measures to help protect the privacy of the information stored on our systems
Continue to evaluate and modify our security measures in response to this specific incident and the ever-changing security landscape
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Washington State AGApr 29 · first

California State AGApr 29 · first · this page

Delaware State AG+11d

Indiana State AG+11d

Pattern: first filing Apr 29 (WA), last May 10 (IN) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-540398
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 29, 2021
Raw hash: f4236615402e33a62ab7f5b78a62e029809d6b7e8b77d3ad890261566924c845

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityInsurance Technologies Corporation

Victim entityInsurance Technologies Corporation

IncidentUnauthorized Access

Stated responseImmediately commenced an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov