AccidentalTechnologyInformationMisconfigurationCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Vertaforte

bd_b4d9ce813c090b7e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 30, 2020

Filed

Jul 14, 2021

To disclose

32 weeks

Affected

1state residents only

Confidence

67%

Full breach record for Vertaforte →

Vertafore disclosed a configuration error in its QQCatalyst insurance agency management product discovered on November 30, 2020. The error resulted in unauthorized public access to reports, forms, and potentially insurance applications containing names, addresses, birth dates, driver's license numbers, SSNs, and financial account data. Vertafore fixed the error, engaged forensic investigators, notified federal law enforcement, and offered one year of identity monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 32 weeks / 226 days

Nov 30, 2020

Discovered

Jul 14, 2021

Filed

vs. sector median

+21 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Vertaforte
norm: vertaforte

Name: Vertaforte
norm: vertaforte
Industry: Technologyllm

Discovered: Nov 30, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Regulator citations: Reported the matter to U.S. federal law enforcement

During the incident: Fixed the configuration error and secured the potentially affected files
Engaged a leading security firm to search for evidence indicating potential misuse of the information
Reported the matter to U.S. federal law enforcement
Offering one year of free identity monitoring services
Changes made: Working to further enhance security tools, policies, and procedures
Enhancing security governance and staffing
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(226 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/a-notif-81.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 14, 2021
Raw hash: f0b8f217b427b32117a327bfffe9f26ce19e822e1b3efe829b9215a055754329

Reporting entityVertaforte

Victim entityVertaforte

Incidentdiscovered Nov 30, 2020

Stated responseFixed the configuration error and secured the potentially affected files

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov