HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Noblr Reciprocal Exchange

bd_bc73eb4b9fc8a844 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 27, 2021

Filed

May 7, 2021

To disclose

14 weeks

Affected · nationwide

97,63368 in this filing

Linked

3 filings

Confidence

66%

Full breach record for Noblr Reciprocal Exchange →

Noblr Reciprocal Exchange experienced an external system breach (hacking) on January 21, 2021, discovered on January 27, 2021. The incident compromised the names and driver's license numbers of 97,633 individuals, including 68 Maine residents. The entity provided written notification on May 14, 2021, and offered one year of Experian IdentityWorks identity protection services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 27, 2021 → Filed with AG May 7, 2021100d ✗ ME AG >90d14 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 6 days

discovery → filing · 14 weeks / 100 days

Jan 21, 2021

Begins

Jan 27, 2021

Discovered

May 7, 2021

Filed

vs. sector median

+6 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_93953ad731b87c972021-05-07Verified
New Hampshire State AGbd_9f4988550e1c19de2021-05-10 · +3dVerified

Name: NOBLR, INC.
norm: noblr
Industry: Financial Services

Name: Noblr Reciprocal Exchange
norm: noblr reciprocal exchange
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jan 27, 2021
Breach occurred: Jan 21, 2021
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 14, 2021
Affected individuals: 97,633state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Driver's licence number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 1 year of Experian IdentityWorks which includes fraud monitoring, credit remediation support, and insurance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: ME AG >90d · 100dME resident >60d · 107d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 27, 2021
→ Filed with AG: May 7, 2021
100d 90 days ME AG >90d
Maine
Discovered: Jan 27, 2021
→ Notified: May 14, 2021
107d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 27, 2021 → Filed with AG: May 7, 2021	100d	90 days	ME AG >90d
Maine	Discovered: Jan 27, 2021 → Notified: May 14, 2021	107d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGMay 7 · first

Maine State AGMay 7 · first · this page

New Hampshire State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/c43bf2a1-cea9-45fa-81bf-47d299a7216d.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2021
Raw hash: 86b58ad69e74bee60174db9f85f2cc640a31fca702416a095c332b8ef5364578

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNOBLR, INC.

Victim entityNoblr Reciprocal Exchange

Incidentdiscovered Jan 27, 2021

Stated responseSent written notification to affected individuals

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov