Woodruff Sawyer & Co.
bd_751f17dbb3c4b49c · schema v1 · pii pii-v1
Full breach record for Woodruff Sawyer & Co. →Woodruff-Sawyer & Co., an insurance brokerage and risk consulting firm based in San Francisco, reported a cybersecurity incident to the Maine Attorney General. On January 20, 2024, an executive was targeted by a SIM-swapping attack, allowing an unauthorized actor to reset work passwords and access cloud systems. The actor downloaded a subset of files containing client data, specifically names and driver's license numbers. The breach affected 3,087 individuals, including 25 Maine residents. Notification was sent on March 4, 2024, offering 24 months of credit monitoring and identity restoration services.
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_cc972661d63c3feeMontana State AGfiled 2024-03-04Verified
- bd_d17b63c8574e8287Indiana State AGfiled 2024-03-04Verified
- bd_c827d916f6654c94New Hampshire State AGfiled 2024-03-18(14d gap)Verified
- bd_cdf69a212ead0ef1California State AGfiled 2024-03-20(16d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c47cb5aa-4651-409b-a808-f9cfa3ec377f.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2024
- Raw hash
- c78a63ede2a550fb086bf95acff54bcd23f310e39846630d2aa0fc8856db827a
Reporting entity
- Name
- Woodruff Sawyer & Co.norm: woodruff sawyer
- Domain
- woodruffsawyer.com
Victim entity
- Name
- Woodruff Sawyer & Co.norm: woodruff sawyer
- Domain
- woodruffsawyer.com
Incident
- Discovered
- Feb 5, 2024
- Materiality determined
- —
- Notification sent
- Mar 4, 2024
- Affected individuals
- 3,087
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1608 Skillful AccessT1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 28 days(28 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 28d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 5, 2024→ Filed with AG: Mar 4, 202428d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.