AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

Noblr Reciprocal Exchange

bd_9f4988550e1c19de · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 21, 2021

Filed

May 10, 2021

To disclose

16 weeks

Affected

65state residents only

Linked

3 filings

Confidence

67%

Full breach record for Noblr Reciprocal Exchange →

Noblr Reciprocal Exchange notified the NH Attorney General of a data security event involving unauthorized access to consumer personal information via its public-facing web quotes feature. On January 21, 2021, Noblr detected unusual quote activity and bot traffic intended to scrape driver's license numbers inadvertently included in unredacted page source code. The incident affected at least 65 New Hampshire residents. Noblr masked driver's license numbers and other PII in source code and application pages, blocked suspicious IPs, and adjusted rate limits. Free identity theft protection services were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 109 days

Jan 21, 2021

Discovered

May 10, 2021

Filed

vs. sector median

+7 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_93953ad731b87c972021-05-07 · +3dVerified
Maine State AGbd_bc73eb4b9fc8a8442021-05-07 · +3dCandidate

Name: Noblr Reciprocal Exchange
norm: noblr reciprocal exchange

Name: Noblr Reciprocal Exchange
norm: noblr reciprocal exchange
Industry: Financial Servicesllm

Discovered: Jan 21, 2021
Materiality determined: —
Notification sent: May 14, 2021
Affected individuals: 65state-resident count only
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Threat actor: External
Regulator citations: Submitted notice to the New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Began blocking suspicious IP addresses
Altered its instant quote system in order to mask all driver's license numbers in the source code and in the final application page
Constantly revise rate limit thresholds on its quote page adjusting to traffic patterns to combat these attacks
Began masking additional information returned from Verisk Analytics, including dates of birth and vehicle identification numbers, in the source code and insurance application page
Changes made: Provide free identity theft protection services
Notify consumer reporting agencies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(109 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 7 · first

Maine State AGMay 7 · first

New Hampshire State AG+3d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/noblr-reciprocal-exchanger-20210510.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 10, 2021
Raw hash: 6c61c1406349daa50f973b83f9b4260729611b5183ca3af7163c23a407cb293b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNoblr Reciprocal Exchange

Victim entityNoblr Reciprocal Exchange

Incidentdiscovered Jan 21, 2021

Stated responseLaunched an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov