HackingFinancial ServicesTechnologyFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)MediumContained

Minnesota Lawyers Mutual Insurance

bd_d20d5cc0e8f9e5eb · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 23, 2025

Filed

Jul 21, 2025

To disclose

—

Affected

163state residents only

Linked

4 records

Confidence

66%

Full breach record for Minnesota Lawyers Mutual Insurance →

Minnesota Lawyers Mutual Insurance Company (MLMIC) reported a data breach affecting 163 Nebraska residents. Unauthorized access occurred between Feb 20 and Mar 23, 2025, resulting in the exfiltration of names, SSNs, driver's license numbers, financial account info, and medical claims. MLMIC detected the breach on Mar 23, 2025, and notified affected individuals on Jul 21, 2025. Remediation included forensic investigation, enhanced security controls, employee training, and 24 months of credit monitoring via Experian.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 31 days

Feb 20, 2025

Begins

Mar 23, 2025

Discovered

Jul 21, 2025

Filed

This filing is one of 4 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitehunters_internationalbd_9605737d7e4303952025-04-28 · +84dVerified by operator

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_406a79484213c84f2025-07-21Verified by operator
Massachusetts State AGbd_73dcf0240cfdfe172025-07-21Verified by operator

Name: Minnesota Lawyers Mutual Insurance
norm: minnesota lawyers mutual insurance
Domain: mlmins.com

Name: Minnesota Lawyers Mutual Insurance
norm: minnesota lawyers mutual insurance
Domain: mlmins.com
Industry: Financial ServicesllmTechnologyllm

Discovered: Mar 23, 2025
Breach occurred: Feb 20, 2025 – Mar 23, 2025
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 21, 2025
Affected individuals: 163state-resident count only
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: providing written notice of this incident to relevant state regulators, as necessary, and to the three major credit reporting agencies
Initial access: exploit_public_facing

During the incident: Launched a comprehensive investigation with the assistance of cybersecurity specialists
Performed a time-intensive third-party review of the impacted files
Undertook a detailed internal review of their records to identify contact information
Provided access to credit monitoring and identity restoration services for twenty-four (24) months, through Experian
Established a toll-free assistance line
Changes made: Implemented additional technical controls and administrative safeguards
Provided cybersecurity training to its employees
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Indiana State AGJul 21 · first

Massachusetts State AGJul 21 · first

Nebraska State AGJul 21 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/a2a9dccf-5e0d-409b-b5e3-722584682e65.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 21, 2025
Raw hash: d38310e452762b94a7290b7fc0083f731cd62e3624c7a9c6a76862960cffcea8

Linked disclosures

Ransomware claims (1)

Regulatory filings (2) · sorted by filing gap

Reporting entityMinnesota Lawyers Mutual Insurance

Victim entityMinnesota Lawyers Mutual Insurance

Incidentdiscovered Mar 23, 2025

Stated responseLaunched a comprehensive investigation with the assistance of cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov