HackingProfessional ServicesFinancial ServicesProfessional ServicesCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

Government Employees Insurance Companies

bd_eddc405cf4130570 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2021

Filed

Jun 28, 2022

To disclose

46 weeks

Affected

21state residents only

Linked

6 filings

Confidence

66%

Smith, Gambrell & Russell, LLP notified clients of GEICO that unauthorized access to IT systems on August 9, 2021 may have exposed personal information including names, driver's license numbers, and addresses. The firm engaged forensic specialists and law enforcement, implemented enhanced security controls, and offered identity theft protection services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 46 weeks / 323 days

Aug 9, 2021

Discovered

Jun 28, 2022

Filed

vs. sector median

+28 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Maine State AGbd_2b7bfafa570976dc2022-06-28Verified
Maine State AGbd_a79f772ed36790182022-08-08 · +41dVerified
Washington State AGbd_be4969b025e7c48d2022-12-13 · +168dVerified
Vermont State AGbd_37ca2b6de1bd12f42023-01-27 · +213dVerified

Show 1 more filing ↓up to 246d gap

California State AGbd_4870caeeb4e8f2162023-03-01 · +246dVerified

Name: SMITH GAMBRELL & RUSSELL LLP
norm: smith gambrell russell
Domain: sgrlaw.com

Name: Government Employees Insurance Companies
norm: government employees insurance
Domain: sgrlaw.com
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: Aug 9, 2021
Materiality determined: —
Notification sent: Jun 28, 2022
Affected individuals: 21state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: External
Regulator citations: contacted law enforcementnotified and is cooperating with law enforcement

During the incident: Implemented incident response protocols
Contacted law enforcement
Hired external computer forensic specialists and other consultants
Hired a vendor to review the potentially impacted documents
Notified and is cooperating with law enforcement
Changes made: Deployed enhanced endpoint monitoring software on our computers and servers
Performed a global password reset for all users
Provided additional security training
Implemented several other security controls
Offering identity theft protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(323 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Maine State AGJun 28 · first

Montana State AGJun 28 · first · this page

Maine State AG+41d

Washington State AG+168d

Vermont State AG+213d

California State AG+246d

Pattern: first filing Jun 28 (ME), last Mar 1 (CA) — a 246-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-361.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2022
Raw hash: 60a2ab7d99d66370abc5733904f0ab8ea68ba80ad0a1ef1c8a18e7664b8309e7

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entitySMITH GAMBRELL & RUSSELL LLP

Victim entityGovernment Employees Insurance Companies

Incidentdiscovered Aug 9, 2021

Stated responseImplemented incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov