HackingFinancial ServicesFinanceStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

Insureon Holdings, LLC

bd_fd5e9ff5d0c3d012 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 1, 2021

Filed

Nov 8, 2021

To disclose

10 weeks

Affected

671state residents only

Linked

7 filings

Confidence

70%

Full breach record for Insureon Holdings, LLC →

Insureon Holdings, LLC reported unauthorized access to its network in early September 2021, affecting 671 Washington residents. Personal information including names, dates of birth, and Social Security Numbers was potentially accessed. Insureon secured its network, notified the Washington AG, and offered 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 68 days

Sep 1, 2021

Begins

Sep 1, 2021

Discovered

Nov 8, 2021

Filed

vs. sector median

+1 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_31295bffab2e5d7e2021-11-08Verified
Massachusetts State AGbd_c4529879ec06a8c82021-11-09 · +1dVerified
Montana State AGbd_4f9464f6776a35a02021-11-05 · +3dVerified
Indiana State AGbd_d7618d6f257de48c2021-11-05 · +3dVerified

Show 2 more filings ↓up to 77d gap

Maine State AGbd_a266ef352f5a631c2021-10-28 · +11dCandidate
Maine State AGbd_abc75dbe840694972022-01-24 · +77dVerified

Name: Insureon Holdings, LLC
norm: insureon holdings

Name: Insureon Holdings, LLC
norm: insureon holdings
Industry: Financial Servicesllm

Discovered: Sep 1, 2021
Breach occurred: Sep 1, 2021 – Sep 12, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2021
Affected individuals: 671state-resident count only
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Washington Office of the Attorney General
Initial access: valid_credentials

During the incident: Initiated an investigation
Secured its network
Mailed notice to the affected Washington residents
Offering a 12 month subscription to credit monitoring and identity protection services through Equifax, at no cost
Changes made: Taken additional steps to secure our systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Maine State AGOct 28 · first

Montana State AG+8d

Indiana State AG+8d

Maine State AG+11d

Washington State AG+11d · this page

Massachusetts State AG+12d

Maine State AG+88d

Pattern: first filing Oct 28 (ME), last Jan 24 (ME) — a 88-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA3159.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 8, 2021
Raw hash: efd4b6491c9fa273ec6724ed8daa218eb34bcc5f6d35367ec510d9fa31972362

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityInsureon Holdings, LLC

Victim entityInsureon Holdings, LLC

Incidentdiscovered Sep 1, 2021

Stated responseInitiated an investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com