MisuseFinancial ServicesFinancePrivilege AbuseCustomer Data InvolvedGovernment IDFinancial accountMediumContained

Progressive Direct Insurance Company

bd_d5ee6b592ebe709c · schema v1 · pii pii-v2

Severity

Medium

Discovered

Mar 1, 2025

Filed

Jul 25, 2025

To disclose

—

Affected

27state residents only

Linked

4 filings

Confidence

66%

Full breach record for Progressive Direct Insurance Company →2 incidents on file

Progressive Direct Insurance Company notified 27 Nebraska residents that an employee used a false identity to obtain employment and accessed customer data (driver's license, payment card, financial account numbers) between Oct 2023 and Apr 2025. No evidence of misuse was found. Notifications were mailed July 25, 2025, offering two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 495 days

Oct 23, 2023

Begins

Mar 1, 2025

Discovered

Jul 25, 2025

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_4b7a5fdf2b45ade72025-07-25Candidate
Massachusetts State AGbd_7ceaad6a5f5596cc2025-07-25Verified
Indiana State AGbd_cf99bb4cecf484a02025-07-25Verified

Name: Progressive Direct Insurance Company
norm: progressive direct insurance

Name: Progressive Direct Insurance Company
norm: progressive direct insurance
Industry: Financial Servicesllm

Discovered: Mar 1, 2025
Breach occurred: Oct 23, 2023 – Apr 27, 2025
Undetected for: 495 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 25, 2025
Affected individuals: 27state-resident count only
Data types: Government IDFinancial account
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Began an internal investigation
Mailed notification letters via United States First-Class mail
Offered two years of free credit monitoring and identity theft restoration services through Kroll
Established a call center to answer individuals’ questions
Changes made: Offered two years of free identity monitoring services through Kroll
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Vermont State AGJul 25 · first

Massachusetts State AGJul 25 · first

Indiana State AGJul 25 · first

Nebraska State AGJul 25 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/59123c99-7278-4621-a0f9-8f4a8562d90b.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 25, 2025
Raw hash: 69dc16c0afbf548180b3de75c3c60edcb5628065c9d98df29be53bece3bd8404

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityProgressive Direct Insurance Company

Victim entityProgressive Direct Insurance Company

Incidentdiscovered Mar 1, 2025

Stated responseBegan an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov