AccidentalTechnologyFinancial ServicesInformationMisconfigurationData ExfiltratedIdentity (basic)Government IDFinancial accountMediumContained

Vertafore

bd_9c928ea0ee207680 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Jul 1, 2021

To disclose

30 weeks

Affected

3state residents only

Linked

4 filings

Confidence

67%

Vertafore, a third-party provider of insurance agency management software (QQCatalyst), experienced a configuration error on November 30, 2020, leading to unauthorized public access to reports and forms. The breach potentially exposed names, addresses, birth dates, driver's license numbers, SSNs, and financial account information for customers of Kelly Klee, Inc. Vertafore fixed the error, engaged forensic investigators, notified law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 30 weeks / 213 days

Nov 30, 2020

Discovered

Jul 1, 2021

Filed

vs. sector median

+12 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_caa7b1c2031e35cf2021-07-01Verified
Indiana State AGbd_ea319c75c84bcffc2021-07-08 · +7dVerified
Idaho State AGbd_316ff599821890f62021-07-14 · +13dVerified

Name: Kelly Klee, Inc.
norm: kelly klee

Name: Vertafore
norm: vertafore
Industry: TechnologyllmFinancial Servicesllm

Discovered: Nov 30, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid Accounts
Regulator citations: Reported the matter to U.S. federal law enforcement
Third party: via Vertafore

During the incident: Fixed the configuration error and secured the potentially affected files
Engaged a leading security firm to search for evidence indicating potential misuse
Reported the matter to U.S. federal law enforcement
Offering one year of free credit and identity monitoring services
Changes made: Working to further enhance security tools, policies, and procedures
Enhancing security governance and staffing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(213 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGJul 1 · first

Montana State AGJul 1 · first · this page

Indiana State AG+7d

Idaho State AG+13d

Pattern: first filing Jul 1 (MA), last Jul 14 (ID) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/kellySamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 1, 2021
Raw hash: 1abe02afc010ea0c01662bcfb1bebc3b4560614167ff0bc8e7b15019474ab06a

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityKelly Klee, Inc.

Victim entityVertafore

Incidentdiscovered Nov 30, 2020

Stated responseFixed the configuration error and secured the potentially affected files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov