AccidentalFinancial ServicesHealthcareFinanceMisconfigurationCustomer Data InvolvedPIIPHIIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

BackNine Insurance and Financial Services, Inc.

bd_f6266be19daceb2c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 12, 2021

Filed

Aug 17, 2021

To disclose

5 weeks

Affected

Not disclosed

Linked

8 filings

Confidence

65%

Full breach record for BackNine Insurance and Financial Services, Inc. →

BackNine Insurance and Financial Services, Inc. disclosed a data security issue discovered on July 12, 2021, caused by a coding error that uploaded insurance and annuity applications to a publicly accessible cloud storage folder. The exposure window spans from April 23, 2015, to July 12, 2021. Affected data includes personal information (PI) and protected health information (PHI), such as names, addresses, SSNs, and health details. The company secured the folder, audited the system, and offered identity protection services. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 12, 2021 → Notified Aug 13, 202132d ✓ CA 60-day OK5 weeks discovery → filing

Incident timeline

undetected · 2272 days

discovery → filing · 5 weeks / 36 days

Apr 23, 2015

Begins

Jul 12, 2021

Discovered

Aug 17, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_4ce68e7cc28dddcf2021-08-17Verified
Oregon State AGbd_bf4eff08713081142021-08-17Verified
Massachusetts State AGbd_9240e3f3f800e2792021-08-18 · +1dVerified
Maine State AGbd_a3139dfc8b843b512021-08-18 · +1dVerified

Show 3 more filings ↓up to 228d gap

Indiana State AGbd_d878c5fd1831b3002021-08-13 · +4dVerified
Montana State AGbd_04b76c0a63bd345d2021-08-12 · +5dVerified
Illinois State AGbd_85596477ba14fd2e2021-01-01 · +228dCandidate

Name: BackNine Insurance and Financial Services, Inc.
norm: backnine insurance and financial

Name: BackNine Insurance and Financial Services, Inc.
norm: backnine insurance and financial
Industry: Financial ServicesllmHealthcarellm

Discovered: Jul 12, 2021
Breach occurred: Apr 23, 2015 – Jul 12, 2021
Undetected for: 2,272 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 13, 2021
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)Financial account
Attack vector: Misconfiguration

During the incident: Immediately secured the folder so that it was no longer publicly accessible
Audited the cloud storage system to confirm that the folder at issue was the only one affected
Altered the misconfigured code to ensure that future applications would be uploaded to and stored in the intended, non-publicly accessible folders
Conducted an investigation with the assistance of outside data privacy and cybersecurity experts
Offering free identity protection services through IDX
Changes made: Implementing additional security measures to protect the information on our systems and to minimize the likelihood of a similar situation occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: CA 60-day OK · 32d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 12, 2021
→ Notified: Aug 13, 2021
32d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 12, 2021 → Notified: Aug 13, 2021	32d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGJan 1 · first

Montana State AG+223d

Indiana State AG+224d

Washington State AG+228d

Oregon State AG+228d

California State AG+228d · this page

Massachusetts State AG+229d

Maine State AG+229d

Pattern: first filing Jan 1 (IL), last Aug 18 (ME) — a 229-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-543955
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2021
Raw hash: 14334846b29cd43c6e7ea4fcc2ece7c30845621cd555867a8bd844972e17a000

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityBackNine Insurance and Financial Services, Inc.

Victim entityBackNine Insurance and Financial Services, Inc.

Incidentdiscovered Jul 12, 2021

Stated responseImmediately secured the folder so that it was no longer publicly accessible

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov