HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Government IDIdentity (basic)CriticalContained

American Family Mutual Insurance Company, S.I.

bd_81e6df6c496ead25 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 18, 2021

Filed

May 11, 2021

To disclose

8 weeks

Affected · nationwide

283,73486 in this filing

Linked

5 filings

Confidence

66%

Full breach record for American Family Mutual Insurance Company, S.I. →

American Family Mutual Insurance Company, S.I. reported unauthorized automated bot activity on its amfam.com quoting platform between February 6 and March 7, 2021. The bots obtained driver's license numbers via a third-party prefill supplier. Approximately 283,734 unique driver's license numbers were exposed, including 86 New Hampshire residents. The company took the platform offline, implemented security controls, and offered one year of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 40 days

discovery → filing · 8 weeks / 54 days

Feb 6, 2021

Begins

Mar 18, 2021

Discovered

May 11, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_0fce8eaa10bdff6f2021-05-13 · +2dVerified
Indiana State AGbd_8c29c1b8607d81072021-05-13 · +2dVerified
Washington State AGbd_b099a3c4e2d384b72021-05-13 · +2dVerified
Illinois State AGbd_06e63c1593d7b6c02021-01-01 · +130dCandidate

Name: American Family Mutual Insurance Company, S.I.
norm: american family mutual insurance company si

Name: American Family Mutual Insurance Company, S.I.
norm: american family mutual insurance company si
Industry: Financial Servicesllm

Discovered: Mar 18, 2021
Breach occurred: Feb 6, 2021 – Mar 7, 2021
Undetected for: 40 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 13, 2021
Affected individuals: 283,734state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Took the platform offline on March 19, 2021
Implemented server-side masking of driver’s license numbers and dates of birth
Blocked IP addresses and known attacker form submission patterns at both the firewall and Application Programming Interface (“API”) gateway
Implemented recaptcha on the primary quoting platform for amfam.com
Deploying web application firewall and API security capabilities
Changes made: Offering consumers receiving the notification letter one year of credit monitoring and resolution services through CyberScout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

New Hampshire State AG+130d · this page

California State AG+132d

Indiana State AG+132d

Washington State AG+132d

Pattern: first filing Jan 1 (IL), last May 13 (WA) — a 132-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/american-family-mutual-insurance-20210511.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 11, 2021
Raw hash: acae3cbf15039f797aad5e63216767b8593b2133f9714aa1801fb72ab1e2bf88

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityAmerican Family Mutual Insurance Company, S.I.

Victim entityAmerican Family Mutual Insurance Company, S.I.

Incidentdiscovered Mar 18, 2021

Stated responseTook the platform offline on March 19, 2021

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov