HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Hagerty Insurance Agency, LLC

bd_b1562bb773105c26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 2, 2021

Filed

Mar 23, 2021

To disclose

7 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

65%

Full breach record for Hagerty Insurance Agency, LLC →2 incidents on file

Hagerty Insurance Agency, LLC disclosed that automated bots exploited a vulnerability in its public-facing 'Instant Quote' feature to access personal information, including names, driver's license numbers, and dates of birth, embedded in the webpage source code. The incident was detected on February 2, 2021, when suspicious quote activity was observed. Hagerty immediately deployed mechanisms to block bot activity and contained the incident. Affected individuals were offered 12 months of complimentary identity theft protection through Experian.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 2, 2021 → Notified Mar 23, 202149d ✓ CA 60-day OK7 weeks discovery → filing

Incident timeline

discovery → filing · 7 weeks / 49 days

Feb 2, 2021

Begins

Feb 2, 2021

Discovered

Mar 23, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_3020886c24aff5f12021-03-23Verified
Massachusetts State AGbd_bf71b6b8ded5d8042021-03-23Verified
Maine State AGbd_b16e684014a061292021-03-26 · +3dCandidate
Indiana State AGbd_40ca59323f999df62021-04-09 · +17dVerified

Show 1 more filing ↓up to 21d gap

Montana State AGbd_083cd91b97919bf72021-04-13 · +21dVerified by operator

Name: Hagerty Insurance Agency, LLC
norm: hagerty insurance agency

Name: Hagerty Insurance Agency, LLC
norm: hagerty insurance agency
Industry: Financial Servicesllm

Discovered: Feb 2, 2021
Breach occurred: Feb 2, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Deployed mechanisms to detect, prevent, and block bot activity in our quote system
Implemented processes and protocols to mitigate this type of activity
Offering complimentary access to Experian IdentityWorks for 12 months
Changes made: Implemented processes and protocols to mitigate bot activity
Deployed mechanisms to detect, prevent, and block bot activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: CA 60-day OK · 49d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 2, 2021
→ Notified: Mar 23, 2021
49d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 2, 2021 → Notified: Mar 23, 2021	49d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

New Hampshire State AGMar 23 · first

Massachusetts State AGMar 23 · first

California State AGMar 23 · first · this page

Maine State AG+3d

Indiana State AG+17d

Montana State AG+21d

Pattern: first filing Mar 23 (NH), last Apr 13 (MT) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539374
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2021
Raw hash: 6dc28ac7714bf9ed57d71ab7901bf0958c64edc55a4be9144b52dc2379629d4a

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityHagerty Insurance Agency, LLC

Victim entityHagerty Insurance Agency, LLC

Incidentdiscovered Feb 2, 2021

Stated responseDeployed mechanisms to detect, prevent, and block bot activity in our quote system

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov