HackingFinancial ServicesFinanceAbuse Of FunctionalityCapture App DataCustomer Data InvolvedData ExfiltratedGovernment IDMediumContained

Midvale Indemnity Company

bd_ae879f20acc43f16 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 13, 2021

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

82%

Full breach record for Midvale Indemnity Company →

Midvale Indemnity Company notified consumers of an unauthorized bot attack on its online auto insurance quoting platform between January 19–29, 2021. Unauthorized parties used automated bot processes and personal information from unknown sources to extract driver's license numbers from the platform. Affected individuals were offered 12 months of free credit monitoring through Cyberscout/Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

Jan 19, 2021

Begins

May 13, 2021

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_15270ca6b10b74bd2021-05-13Verified
Massachusetts State AGbd_0bd19c01a4e40c782021-05-12 · +1dCandidate

Name: Midvale Indemnity Company
norm: midvale indemnity

Name: Midvale Indemnity Company
norm: midvale indemnity
Industry: Insurance
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Jan 19, 2021 – Jan 29, 2021
Materiality determined: —
Notification sent: May 13, 2021
Affected individuals: Not disclosed
Data types: Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Identified the unauthorized activity and immediately took action to address it
Blocked the activity and worked to notify potentially affected consumers
Offering Single Bureau Credit Monitoring services free of charge through Cyberscout for twelve months
Changes made: Enhanced our security controls to help prevent this type of incident from reoccurring
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 12 · first

Indiana State AG+1d

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-540820
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2021
Raw hash: 4cdbf5b544f0bbf07d9af1a765c902f573681ebedff69a27a5b299450b0f015f

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMidvale Indemnity Company

Victim entityMidvale Indemnity Company

IncidentUnauthorized Access

Stated responseIdentified the unauthorized activity and immediately took action to address it

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov