HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedIdentity (basic)PIILowContained

Ryan Specialty Group, LLC

bd_70d3ae0ea00b12ef · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 17, 2021

Filed

Jul 30, 2021

To disclose

15 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Ryan Specialty Group, LLC →

Ryan Specialty Group, LLC experienced unauthorized access to certain employee email accounts between April 4 and April 20, 2021. The company became aware of unusual activity on April 17, 2021. Personal information, including names and other elements, was accessible within these accounts. RSG reset passwords, blocked malicious IPs, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 13 days

discovery → filing · 15 weeks / 104 days

Apr 4, 2021

Begins

Apr 17, 2021

Discovered

Jul 30, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_83339b3b19401dee2021-07-30Verified
Indiana State AGbd_b0d1fd3d1a31232b2021-07-30Verified
New Hampshire State AGbd_4d8e164ecd2348c02021-08-09 · +10dVerified

Name: Ryan Specialty Group, LLC
norm: ryan specialty

Name: Ryan Specialty Group, LLC
norm: ryan specialty
Industry: Financial Servicesllm

Discovered: Apr 17, 2021
Breach occurred: Apr 4, 2021 – Apr 20, 2021
Undetected for: 13 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)PII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External

During the incident: Resetting relevant account passwords
Blocking potentially malicious IP addresses
Removing any suspicious emails from RSG mailboxes
Reviewing for and disabling any suspicious rules within RSG mailboxes
Opening investigations with our email solutions and managed services providers
Changes made: Reviewing existing policies and procedures to reduce the likelihood of a similar future incident
Offering access to complimentary credit monitoring and identity protection services for twenty-four (24) months through Experian
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(104 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 30 · first

Indiana State AGJul 30 · first

California State AGJul 30 · first · this page

New Hampshire State AG+10d

Pattern: first filing Jul 30 (MA), last Aug 9 (NH) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-543396
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 30, 2021
Raw hash: 5ba9f67ef567cbc42740a0839fb6da0857b3ebb75483578a56222c7ff6c5e101

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRyan Specialty Group, LLC

Victim entityRyan Specialty Group, LLC

Incidentdiscovered Apr 17, 2021

Stated responseResetting relevant account passwords

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov