HackingFinancial ServicesFinanceData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedPIILowContained

CRC Insurance Services, LLC

bd_6db08079d0fd60ad · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Dec 8, 2023

To disclose

—

Affected

48scope not determined

Linked

2 filings

Confidence

67%

Full breach record for CRC Insurance Services, LLC →5 incidents on file

CRC Insurance Services, LLC, a wholesale insurance brokerage, filed a supplemental notice with the Idaho Attorney General regarding a breach involving a third-party vendor. The incident potentially affected the personal information of 48 Idaho residents. CRC offered one year of complimentary credit monitoring to affected individuals not associated with business partners.

J jump to incidentP pin to compareR raw source

Incident timeline — partial

? — ?

Breach window unknown

Dec 8, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_d3c3dce79bdf46a62023-12-08Verified

Name: Lockelord LLP
norm: lockelord

Name: CRC Insurance Services, LLC
norm: crc insurance
Industry: Financial Servicesllm

Discovered: —
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: 48scope not determined
Data types: PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: Partner
Regulator citations: Filed supplemental notice with the Office of the Attorney General, State of Idaho
Initial access: supply_chain

During the incident: Offering credit monitoring services for 1 years at no cost to the affected individuals that are not associated with a business partner or are associated directly with CRC
Coordinating with relevant business partners who own the data to help meet individual notification obligations
Sent notices to residents who are not associated with a CRC business partner
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGDec 8 · first

Idaho State AGDec 8 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/12/12-08-2023-CRC-Insurance-Services-LLC.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 8, 2023
Raw hash: 56383f6ab5d5faf86fd1fcb7d0411df1d992b36df1d8a1fd5106a4647018b068

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityLockelord LLP

Victim entityCRC Insurance Services, LLC

IncidentThird-Party / Supply Chain

Stated responseOffering credit monitoring services for 1 years at no cost to the affected individuals that are not associated with a business partner or are associated directly with CRC

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov