AccidentalProfessional ServicesProfessional ServicesMisdeliveryCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

Tillett Agency Inc

bd_e2642b9db9b37e1e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 1, 2026

Filed

Jan 2, 2026

To disclose

≤1 day

Affected

Confidence

66%

Full breach record for Tillett Agency Inc →

The Tillett Agency Inc reported an inadvertent email misdelivery in Washington on Jan 1, 2026, exposing one resident's Medicare number, DOB, and SSN. The agency contained the incident, secured deletion by the unintended recipient, and offered credit monitoring. Remediation included switching to secure document sharing.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d≤1 day discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · ≤1 day / 1 days

Jan 1, 2026

Begins

Jan 1, 2026

Discovered

Jan 2, 2026

Filed

vs. sector median

14 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Tillett Agency Inc
norm: tillett agency

Name: Tillett Agency Inc
norm: tillett agency
Industry: Professional Servicesllm

Discovered: Jan 1, 2026
Breach occurred: Jan 1, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 2, 2026
Affected individuals: 1state + nationwide
Data types: Government IDIdentity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1535 Untrusted Email
Threat actor: Internal

During the incident: Documented the incident and notified the appropriate compliance contacts
Contacted the unintended recipient and required deletion of the email and attachment
Requesting written confirmation of deletion
Offering credit monitoring and identity theft protection at no cost
Offering assistance with placing a fraud alert on credit file
Changes made: Updated internal processes so that documents containing sensitive personal information are no longer sent through regular email and are instead shared only through secure methods
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36033.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 2, 2026
Raw hash: 57f6c04cba77e0abb1a0df26bf0acb3b737fa1cff8bfa4c235b9f6d71709632f

Reporting entityTillett Agency Inc

Victim entityTillett Agency Inc

Incidentdiscovered Jan 1, 2026

Stated responseDocumented the incident and notified the appropriate compliance contacts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com