HackingFinancial ServicesFinanceVulnerability ExploitTargetedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

Metromile Insurance Company

bd_ff07db480409627b · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 19, 2021

Filed

Mar 5, 2021

To disclose

6 weeks

Affected

1,400state residents only

Linked

6 filings

Confidence

70%

Full breach record for Metromile Insurance Company →2 incidents on file

Metromile Insurance Company reported a cybersecurity incident to the Washington AG. Unknown actors exploited an unlawful method in the online quote form to obtain driver's license numbers and dates of birth. The incident occurred between December 2020 and January 2021, was discovered on Jan 19, 2021, and contained on Jan 20, 2021. Approximately 1,400 Washington residents were affected. Metromile engaged forensic investigators, notified law enforcement, and offered 2 years of identity protection services.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d6 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 49 days

discovery → filing · 6 weeks / 45 days

Dec 1, 2020

Begins

Jan 19, 2021

Discovered

Mar 5, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_dbd5ef0b7bbf213a2021-03-05Verified
California State AGbd_437eec22c74c3cd32021-03-06 · +1dVerified
Oregon State AGbd_be40199aebc5a1d52021-03-06 · +1dVerified
Massachusetts State AGbd_d055f1b20edc2ba32021-03-06 · +1dVerified

Show 1 more filing ↓up to 63d gap

Illinois State AGbd_6f6f7bee0a957bd22021-01-01 · +63dCandidate

Name: Metromile Insurance Company
norm: metromile insurance

Name: Metromile Insurance Company
norm: metromile insurance
Industry: Financial Servicesllm

Discovered: Jan 19, 2021
Breach occurred: Dec 1, 2020 – Jan 20, 2021
Undetected for: 49 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 5, 2021
Affected individuals: 1,400state-resident count only
Data types: Government IDIdentity (basic)
Data elements: NameDriver's licence numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General
Initial access: exploit_public_facing

During the incident: Launched an internal investigation
Engaged a cybersecurity firm to assist in the company’s review
Retained an independent forensic investigation firm to assist us in our investigation of and response to this incident
Notified law enforcement
Working with a third-party vendor to send notices
Offering potentially impacted individuals like yourself two years of complimentary identity protection and credit monitoring services
Changes made: Addressed the issue
Offering two years of complimentary identity protection and credit monitoring services from a leading identity monitoring services company
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(45 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJan 1 · first

Indiana State AG+63d

Washington State AG+63d · this page

California State AG+64d

Oregon State AG+64d

Massachusetts State AG+64d

Pattern: first filing Jan 1 (IL), last Mar 6 (MA) — a 64-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10418.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 5, 2021
Raw hash: 4c6a04cff560f37b44d16430ed849e1f9bfaf00b7de5a17b1fc564078363a077

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMetromile Insurance Company

Victim entityMetromile Insurance Company

Incidentdiscovered Jan 19, 2021

Stated responseLaunched an internal investigation

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com