HackingPIIIdentity (basic)LowContained

Insulet Corporation

bd_dc53fa22a54060f9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 19, 2021

Filed

Mar 18, 2021

To disclose

8 weeks

Affected

30state residents only

Linked

4 filings

Confidence

65%

Full breach record for Insulet Corporation →8 incidents on file

Insulet Corporation notified Montana DOJ that its vendor, Cornerstone On-Demand, experienced unauthorized access on Jan 13, 2021. Insulet learned of the incident on Jan 19, 2021. Access involved names, emails, and training records. Insulet is transitioning platforms and requiring data deletion.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 8 weeks / 58 days

Jan 13, 2021

Begins

Jan 19, 2021

Discovered

Mar 18, 2021

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_a9a5e74719a5088f2021-03-19 · +1dVerified
HHS OCRbd_ec64490fbdd5840b2021-03-19 · +1dVerified
Illinois State AGbd_075e4e452f3484bd2021-01-01 · +76dCandidate

Name: Insulet Corporation
norm: insulet
Domain: insulet.com

Name: Insulet Corporation
norm: insulet
Domain: insulet.com

Discovered: Jan 19, 2021
Breach occurred: Jan 13, 2021
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 18, 2021
Affected individuals: 30state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Cornerstone On-Demand
Initial access: valid_credentials

During the incident: Cornerstone blocked the unauthorized third party’s access to Cornerstone’s system
Implemented additional security measures to reduce the likelihood of success of another attack
Completed an extensive review and investigation
Changes made: Transitioning online courses to another vendor’s platform
Require that Cornerstone delete all Insulet customer data once that transition is complete
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+76d · this page

California State AG+77d

HHS OCR+77d

Pattern: first filing Jan 1 (IL), last Mar 19 (MA) — a 77-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/insulete-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2021
Raw hash: cf2b4d633d2262683b252ae00664868d7d0b7925fc4f369de41421b6e1866e1e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityInsulet Corporation

Victim entityInsulet Corporation

Incidentdiscovered Jan 19, 2021

Stated responseCornerstone blocked the unauthorized third party’s access to Cornerstone’s system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov