AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

Vertafore

bd_8c3393904c1de7c7 · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 30, 2020

Filed

Jul 8, 2021

To disclose

31 weeks

Affected

6,099state residents only

Linked

5 filings

Confidence

64%

Full breach record for Vertafore →

Vertafore, a provider of insurance agency management software (QQCatalyst), disclosed a configuration error discovered on November 30, 2020, that resulted in unauthorized public access to reports, forms, and potentially insurance applications. Impacted data included names, addresses, birthdates, driver's license numbers, and potentially SSNs and financial account data. Vertafore secured the files, engaged forensic investigators, and reported the matter to federal law enforcement.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due31 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 31 weeks / 220 days

Nov 30, 2020

Discovered

Jul 8, 2021

Filed

vs. sector median

+13 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

New Hampshire State AGbd_e05b9e1eb99587362021-07-09 · +1dVerified
Montana State AGbd_0b6fb2d524526bb72021-06-16 · +22dCandidate
Montana State AGbd_46b0579fff296ea12021-08-09 · +32dVerified
New Hampshire State AGbd_b417a50418164b432021-09-23 · +77dVerified

Name: Shared Alliance Insurance, Inc.
norm: shared alliance insurance
Domain: sharedalliance.com

Name: Vertafore
norm: vertafore
Industry: Technologyllm

Discovered: Nov 30, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 6,099state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: reported the matter to U.S. federal law enforcement

During the incident: Fixed the configuration error and secured the potentially affected files
Investigating the extent to which data may have been impacted
Reported the matter to U.S. federal law enforcement
Engaged a leading security firm to search for evidence indicating potential misuse of the information
Offering you free identity monitoring services
Changes made: Working to further enhance our security tools, policies and procedures, as well as our security governance and staffing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 31 weeks(220 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Montana State AGJun 16 · first

South Carolina State AG+22d · this page

New Hampshire State AG+23d

Montana State AG+54d

New Hampshire State AG+99d

Pattern: first filing Jun 16 (MT), last Sep 23 (NH) — a 99-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/SharedAllianceInsurance.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2021
Raw hash: 859e13438b99dff6af70231c60e52a5dd14cd0d51129dc88b0a0919442f890e8

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityShared Alliance Insurance, Inc.

Victim entityVertafore

Incidentdiscovered Nov 30, 2020

Stated responseFixed the configuration error and secured the potentially affected files

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov