PhysicalFinancial ServicesFinanceTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountPHIHealth (basic)HighContained

TRINITY UNIVERSAL INSURANCE COMPANY

bd_fbd60cf6d6a4a26e · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 11, 2023

Filed

Feb 9, 2024

To disclose

30 weeks

Affected · nationwide

31,7014,279 in this filing

Linked

8 filings

Confidence

71%

Full breach record for TRINITY UNIVERSAL INSURANCE COMPANY →

Trinity Universal Insurance Company filed a supplemental notice with the Washington AG regarding the loss of a lockbox containing backup tapes. The tapes went missing between July 7-10, 2023, and were discovered missing on July 11, 2023. The tapes contained PII, SSNs, driver's licenses, financial account info, and PHI of 4,279 Washington residents (31,701 total). No indication of misuse was found. Notifications were mailed starting Feb 9, 2024, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 4 days

discovery → filing · 30 weeks / 213 days

Jul 7, 2023

Begins

Jul 11, 2023

Discovered

Feb 9, 2024

Filed

vs. sector median

+22 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Delaware State AGbd_34316efa0793a1b42024-02-09Verified
Oregon State AGbd_99bbabeb732f88972024-02-09Verified by operator
California State AGbd_ba2eaff29b19d9952024-02-09Verified
Indiana State AGbd_c7bf102fc0d1cbf72024-02-09Verified

Show 3 more filings ↓up to 8d gap

Massachusetts State AGbd_1426ce895f4b6cc22024-02-10 · +1dVerified
South Carolina State AGbd_ee1ac64209e671a92024-02-12 · +3dVerified
Illinois State AGbd_de7a90fbc3b2720c2024-02-01 · +8dVerified

Name: TRINITY UNIVERSAL INSURANCE COMPANY
norm: trinity universal insurance

Name: TRINITY UNIVERSAL INSURANCE COMPANY
norm: trinity universal insurance
Industry: Financial Servicesllm

Discovered: Jul 11, 2023
Breach occurred: Jul 7, 2023 – Jul 10, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 9, 2024
Affected individuals: 31,701state + nationwide
Data types: Identity (basic)Government IDFinancial accountPHIHealth (basic)
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified law enforcementInitial report filed with Washington Office of the Attorney General on February 9, 2024

During the incident: Launched an investigation
Notified law enforcement
Conducted a comprehensive review of the data
Began mailing notification letters via United States Postal Service First-Class mail
Provided substitute notice via nationwide media and a website posting
Offered individuals with a Social Security number and/or driver’s license number involved a complimentary membership in credit monitoring and identity theft protection services
Established a toll-free call center to answer any inquiries from individuals
Changes made: Continuing to review its cybersecurity program
Made changes to its processes and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(213 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Illinois State AGFeb 1 · first

Delaware State AG+8d

Oregon State AG+8d

California State AG+8d

Indiana State AG+8d

Washington State AG+8d · this page

Massachusetts State AG+9d

South Carolina State AG+11d

Pattern: first filing Feb 1 (IL), last Feb 12 (SC) — a 11-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA27892.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2024
Raw hash: a4ac29080639ed3562f9eaf203996518a4a7c1eab54af66dd56b539966da2afd

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTRINITY UNIVERSAL INSURANCE COMPANY

Victim entityTRINITY UNIVERSAL INSURANCE COMPANY

Incidentdiscovered Jul 11, 2023

Stated responseLaunched an investigation

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com