HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumActive

Ottawa Kent Insurance Agency

bd_c210847a9fc8e02b · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 15, 2020

To disclose

—

Affected

1state residents only

Linked

4 filings

Confidence

66%

Full breach record for Ottawa Kent Insurance Agency →

Ottawa Kent Insurance Agency notified the NH Attorney General that an unknown third party accessed a single email account without authorization on November 4, 2019. The intruder used the account to send spam. The agency terminated access immediately and launched an investigation. On May 4, 2020, the agency determined that the account contained the full name and Social Security number of one New Hampshire resident. The agency is offering one year of complimentary credit monitoring and advising the resident on fraud alerts and security freezes. The investigation is ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

Nov 4, 2019

Begins

Jun 15, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_9818da40f66b1e312020-06-22 · +7dVerified
Montana State AGbd_7c05f70978850d122020-06-05 · +10dCandidate
Indiana State AGbd_7d112899097ce5512020-06-03 · +12dVerified

Name: Ottawa Kent Insurance Agency
norm: ottawa kent insurance agency
Domain: ottawakent.com

Name: Ottawa Kent Insurance Agency
norm: ottawa kent insurance agency
Domain: ottawakent.com
Industry: Financial Servicesllm

Discovered: —
Breach occurred: Nov 4, 2019
Materiality determined: —
Notification sent: Jun 5, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Immediately terminated the unauthorized access by forcing a password change
Launched an investigation to analyze the extent of any compromise
Worked with outside cybersecurity professionals
Undertook a comprehensive analysis to determine data owners
Providing the affected resident with written notification
Offering the affected resident a complimentary one-year membership with a credit monitoring service
Advising the affected resident about the process for placing fraud alerts and/or security freezes
Provided contact information for the consumer reporting agencies and the Federal Trade Commission
Set up a dedicated and confidential toll-free response line
Changes made: Continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGJun 3 · first

Montana State AG+2d

New Hampshire State AG+12d · this page

Massachusetts State AG+19d

Pattern: first filing Jun 3 (IN), last Jun 22 (MA) — a 19-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/ottawa-kent-insurance-20200615.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 15, 2020
Raw hash: ebdef99f4155b9eae4f8455f9c9ba33b24d9fcc3373b0287e4e74f584dbdc169

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityOttawa Kent Insurance Agency

Victim entityOttawa Kent Insurance Agency

IncidentUnauthorized Access

Stated responseImmediately terminated the unauthorized access by forcing a password change

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov