Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedEmployee Data InvolvedHealth (basic)Identity (basic)Government IDMinorPHIHighResolved

TRUEbenefits LLC

bd_be9433ca128d9c05 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 26, 2017

Filed

Aug 14, 2017

To disclose

7 weeks

Affected

12,327state residents only

Linked

6 filings

Confidence

68%

Full breach record for TRUEbenefits LLC →

TRUEbenefits LLC, an insurance brokerage, reported a phishing incident where an employee's email account was compromised on May 19, 2017. Unauthorized access revealed names, SSNs, and health insurance details of clients' employees and plan members. 12,327 Washington residents were notified. TRUEbenefits engaged forensic investigators, secured accounts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 38 days

discovery → filing · 7 weeks / 49 days

May 19, 2017

Begins

Jun 26, 2017

Discovered

Aug 14, 2017

Filed

vs. sector median

1 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

HHS OCRbd_713de8a4c173160b2017-08-14Verified
Massachusetts State AGbd_d60c0a62678ac3ba2017-08-14Verified
Oregon State AGbd_01042eb2a1c1134f2017-09-18 · +35dVerified
California State AGbd_15431eb24bf8881d2017-09-18 · +35dVerified

Show 1 more filing ↓up to 35d gap

New Hampshire State AGbd_b716761190d6c3c82017-09-18 · +35dVerified

Name: TRUEbenefits LLC
norm: truebenefits

Name: TRUEbenefits LLC
norm: truebenefits
Industry: Financial Servicesllm

Discovered: Jun 26, 2017
Breach occurred: May 19, 2017
Undetected for: 38 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2017
Affected individuals: 12,327state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Minor
Data elements: NameSocial Security numberHealth insurance IDMedical informationDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General Bob Ferguson
Initial access: phishing_link

During the incident: Secured the employee’s email account
Began an investigation
Engaged a leading forensic firm
Conducted a thorough review of the employee’s email account
Notified clients of the incident
Offered complimentary credit monitoring services
Provided call center services
Provided required regulator notifications
Changes made: Conducted additional training and education for its employees regarding phishing emails
Enhanced email security
Amended email retention policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

HHS OCRAug 14 · first

Massachusetts State AGAug 14 · first

Washington State AGAug 14 · first · this page

Oregon State AG+35d

California State AG+35d

New Hampshire State AG+35d

Pattern: first filing Aug 14 (WA), last Sep 18 (NH) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9732.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2017
Raw hash: 9a082bd7d1039be44053294683b46ebf5af75f2252af03df5ad354d498b5b977

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityTRUEbenefits LLC

Victim entityTRUEbenefits LLC

Incidentdiscovered Jun 26, 2017

Stated responseSecured the employee’s email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com