Ethos Technologies Inc
bd_bd4f1101ee601188 · schema v1 · pii pii-v1
Full breach record for Ethos Technologies Inc →Ethos Technologies Inc. disclosed a cyberattack where unauthorized actors exploited its online life insurance application process to access Social Security numbers. The incident occurred between August 4, 2022, and December 9, 2022, but was not discovered until December 8, 2022. Actors used known personal information to trigger a third-party service that returned SSNs in page source code, which were then extracted. Ethos notified the FBI, engaged forensic investigators, and implemented technical code changes. Affected individuals were offered two years of credit monitoring and identity theft protection.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-574634
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 4, 2023
- Raw hash
- 2f4999db032798a6110dda76e31ec34324dc97d5f98e84f1a863d46f2fa30ac7
Reporting entity
- Name
- Ethos Technologies Incnorm: ethos technologies
Victim entity
- Name
- Ethos Technologies Incnorm: ethos technologies
Incident
- Discovered
- Dec 8, 2022
- Materiality determined
- —
- Notification sent
- Aug 7, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified the FBI
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 43 weeks(300 days from discovery to filing)
- Compliance flags
- CA 60-day late · 242d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 8, 2022→ Notified: Aug 7, 2023242d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.