Social EngineeringPhishingStolen CredentialsData ExfiltratedEmployee Data InvolvedIDENTITY_BASICPIILowResolved

CRC Insurance Services, LLC

bd_609f8e75669d9e57 · schema v1 · pii pii-v1

Full breach record for CRC Insurance Services, LLC →

CRC Insurance Services, LLC reported that on January 18, 2023, it determined an unknown third-party gained unauthorized access to a small number of employee email accounts via phishing emails. The actor exfiltrated a small percentage of emails. The breach occurred on January 13, 2023. Affected data may include names, addresses, and other personal information. CRC engaged forensic firms, contained the incident, and offered credit monitoring.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

bd_684512eb7188bc5dMontana State AGfiled 2023-07-26Verified
bd_ef08d8fabbad4f62Idaho State AGfiled 2023-07-26Verified
bd_97f391745ea166b7Vermont State AGfiled 2023-07-19(7d gap)Verified

Source provenance

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-570861
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2023
Raw hash: 9c8a4b160a32b12b5872fc7ff74ec438f9a1d37c9e1820fb08d8898a69f33aa2

Reporting entity

Name: CRC Insurance Services, LLC
norm: crc insurance

Victim entity

Name: CRC Insurance Services, LLC
norm: crc insurance

Incident

Discovered: Jan 18, 2023
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: IDENTITY_BASICPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1114 Email CollectionT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: phishing_link

Compliance

Time to disclose: 27 weeks(189 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.