AccidentalTechnologyFinancial ServicesInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Vertafore

bd_b417a50418164b43 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Sep 23, 2021

To disclose

42 weeks

Affected

45state residents only

Linked

5 filings

Confidence

64%

Full breach record for Vertafore →

Vertafore, provider of the QQCatalyst insurance agency management software, notified Rawson & Sons Insurance Agency LLC of a configuration error in its product that exposed personal information. The error existed between 2012 and December 2020 and was discovered on November 30, 2020. Data potentially exposed included names, addresses, birthdates, driver's license numbers, SSNs, and financial account data. 45 New Hampshire residents were notified on or around August 1, 2021. Vertafore engaged forensic investigators, reported to federal law enforcement, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3256 days

discovery → filing · 42 weeks / 297 days

Jan 1, 2012

Begins

Nov 30, 2020

Discovered

Sep 23, 2021

Filed

vs. sector median

+24 wks slower

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_46b0579fff296ea12021-08-09 · +45dVerified
New Hampshire State AGbd_e05b9e1eb99587362021-07-09 · +76dVerified
South Carolina State AGbd_8c3393904c1de7c72021-07-08 · +77dVerified
Montana State AGbd_0b6fb2d524526bb72021-06-16 · +99dCandidate

Name: Rawson & Sons Insurance Agency LLC
norm: rawson sons insurance agency

Name: Vertafore
norm: vertafore
Industry: TechnologyllmFinancial Servicesllm

Discovered: Nov 30, 2020
Breach occurred: Jan 1, 2012 – Dec 31, 2020
Undetected for: 3,256 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 1, 2021
Affected individuals: 45state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Reported the matter to U.S. federal law enforcement

During the incident: Fixed the configuration error and secured the potentially affected files
Engaged a leading security firm to search for evidence indicating potential misuse of the information
Reported the matter to U.S. federal law enforcement
Offering each individual one year of free credit monitoring and identity restoration services through Kroll
Changes made: Continually monitor network and systems for unusual activity
Working to further enhance security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 42 weeks(297 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Montana State AGJun 16 · first

South Carolina State AG+22d

New Hampshire State AG+23d

Montana State AG+54d

New Hampshire State AG+99d · this page

Pattern: first filing Jun 16 (MT), last Sep 23 (NH) — a 99-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/vertafore-20210923.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 23, 2021
Raw hash: eda138d86706c5b8897583f01173c70d99abc71c6602970f248448315ba3465a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityRawson & Sons Insurance Agency LLC

Victim entityVertafore

Incidentdiscovered Nov 30, 2020

Stated responseFixed the configuration error and secured the potentially affected files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov