HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowContained

GOOSEHEAD INSURANCE, INC.

bd_bccf3fe3ea138107 · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 13, 2025

Filed

Oct 10, 2025

To disclose

30 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for GOOSEHEAD INSURANCE, INC. →

Goosehead Insurance Agency, LLC notified California residents of an unauthorized access incident occurring between March 6 and March 13, 2025. An external actor accessed systems and copied files containing personal information, including names and other breached elements. The company implemented technical security measures and is offering credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d30 weeks discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 30 weeks / 211 days

Mar 6, 2025

Begins

Mar 13, 2025

Discovered

Oct 10, 2025

Filed

vs. sector median

+22 wks slower

This filing is one of 4 about the same incident.View merged incident

A leak claim by chaos about this victim predates this filing by 209 days.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitechaosbd_10664ef8110db8da2025-03-15 · +209dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_c036d85d395a610a2025-10-10Verified by operator
New Hampshire State AGbd_e81990469abb0e6e2025-10-10Verified

Name: GOOSEHEAD INSURANCE, INC.
norm: goosehead insurance
Domain: goosehead.com

Name: GOOSEHEAD INSURANCE, INC.
norm: goosehead insurance
Domain: goosehead.com
Industry: Financial Servicesllm

Discovered: Mar 13, 2025
Breach occurred: Mar 6, 2025 – Mar 13, 2025
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notify applicable regulatory authorities, as required by law

During the incident: Promptly began an investigation
Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Notify applicable regulatory authorities, as required by law
Offering 12/24 months of complimentary access to credit monitoring services through Experian IdentityWorks
Changes made: Implemented additional technical security measures
Reviewing and enhancing existing policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(211 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGOct 10 · first

New Hampshire State AGOct 10 · first

California State AGOct 10 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-612688
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 10, 2025
Raw hash: a1aa5daa7f54e80779f6b2fb7d0bbbeba1be078d6f213f79cd83989960c1f879

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityGOOSEHEAD INSURANCE, INC.

Victim entityGOOSEHEAD INSURANCE, INC.

Incidentdiscovered Mar 13, 2025

Stated responsePromptly began an investigation

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov