Social EngineeringFinancial ServicesFinancePhishingTargetedIdentity (basic)LowContained

Roger Keith and Sons Insurance Agency

bd_a5dda1583c1020cf · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 27, 2025

Filed

Oct 29, 2025

To disclose

39 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

68%

Full breach record for Roger Keith and Sons Insurance Agency →

The Roger Keith and Sons Insurance Agency notified Vermont consumers of a data breach discovered on January 27, 2025. An unauthorized party accessed an employee email account and the network via a phishing attack. The incident involved full names. The agency contained the breach, engaged forensic investigators, and is offering complimentary credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday39 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 39 weeks / 275 days

Jan 27, 2025

Discovered

Oct 29, 2025

Filed

vs. sector median

+31 wks slower

This filing is one of 5 about the same incident.View merged incident

A leak claim by silentransomgroup about this victim predates this filing by 206 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitesilentransomgroupbd_9ffa3f77da088a5e2025-04-05 · +207dCandidate

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_4ed857811d888bdc2025-10-29Verified by operator
Maine State AGbd_8c2533c25818bd182025-10-29Verified
New Hampshire State AGbd_e1cea9af07d1724a2025-11-03 · +5dVerified by operator

Name: Roger Keith and Sons Insurance Agency
norm: roger keith and sons insurance agency
Domain: rogerkeith.com

Name: Roger Keith and Sons Insurance Agency
norm: roger keith and sons insurance agency
Domain: rogerkeith.com
Industry: Financial Servicesllm

Discovered: Jan 27, 2025
Materiality determined: —
Notification sent: Oct 29, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Initial access: phishing_link

During the incident: Immediately launched an investigation
Contained and secured the network and employee email account
Worked very closely with third-party cybersecurity professionals
Conducted a thorough forensic investigation and manual document review
Offering complimentary credit monitoring through Experian IdentityWorks
Changes made: Continually evaluate and modify practices and internal controls to enhance the security and privacy of your information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 39 weeks(275 days from discovery to filing)
Compliance flags: VT AG >45 bdayLeak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Massachusetts State AGOct 29 · first

Maine State AGOct 29 · first

Vermont State AGOct 29 · first · this page

New Hampshire State AG+5d

Pattern: first filing Oct 29 (MA), last Nov 3 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2025-10-29-roger-keith-and-sons-insurance-agency-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 29, 2025
Raw hash: dc0d46370e368f8e300df64ba1e968eca72d7f4cd15d1f5b0398ab05b9badb81

Linked disclosures

Ransomware claims (1)

Regulatory filings (3) · sorted by filing gap

Reporting entityRoger Keith and Sons Insurance Agency

Victim entityRoger Keith and Sons Insurance Agency

Incidentdiscovered Jan 27, 2025

Stated responseImmediately launched an investigation

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov