AccidentalFinancial ServicesFinanceMisconfigurationSupply Chain (3P Vendor)Data ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

New England Risk Management, Inc.

bd_93ff985667e90d1c · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 22, 2021

To disclose

—

Affected

Not disclosed

Confidence

64%

New England Risk Management, Inc. notified the NH Attorney General of a data breach involving its third-party vendor Vertafore. A configuration error in Vertafore's QQCatalyst product (existing 2012-2020) allowed unauthorized public access to reports and forms. Impacted data included names, addresses, birthdates, driver's license numbers, and potentially SSNs and financial account info. Vertafore fixed the error, engaged forensic investigators, and offered 1 year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 1, 2012

Begins

Jun 22, 2021

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: New England Risk Management, Inc.
norm: new england risk management
Domain: nerisk.com
Industry: Insurance

Name: New England Risk Management, Inc.
norm: new england risk management
Domain: nerisk.com
Industry: Insurance
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jan 1, 2012 – Dec 31, 2020
Materiality determined: —
Notification sent: Jun 16, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: Vertafore reported the matter to U.S. federal law enforcement

During the incident: Vertafore fixed the configuration error and secured the potentially affected files
Vertafore engaged a leading security firm to search for evidence indicating potential misuse
Vertafore reported the matter to U.S. federal law enforcement
Vertafore is offering each individual one year of free credit monitoring and identity restoration services through Kroll
Changes made: Vertafore is working to further enhance its security tools, policies, and procedures, as well as its security governance and staffing
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/new-england-risk-management-20210622.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 22, 2021
Raw hash: 162b21cc16b22bcd23825d784e2d20b82e030dc3784496d8ba9a093f541bbd4f

Reporting entityNew England Risk Management, Inc.

Victim entityNew England Risk Management, Inc.

IncidentMisconfiguration

Stated responseVertafore fixed the configuration error and secured the potentially affected files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov