Who: California Department of Insurance (CDI)

# of Accounts Breached: More than 24,450 reports

What was affected: Agents’ name, renewal ID, and Tax Identification Number (TIN). Because many individuals use their Social Security Number as their TIN, there was the possibility that many people could have their name and SSN compromised. Other reports that were exposed by the site’s vulnerability were described as: Insurance claims investigation reports with details such as names, vehicle registration numbers, and addresses; Statistical reports on monthly frauds; and Details of individuals and charges they were indicted for, fines paid impacted parties, etc.

When it happened: November 2018

How it happened: An Indian cybersecurity firm, Banbreach reported a vulnerability involving the California Department of Insurance site. According to Banbreach, they notified the California Department of Insurance (CDI) that interactive.web.insurance.ca.gov was hosting an oracle reporting server that had generated more than 24,450 reports in the prior 24 hours.

Outcome: Banbreach reported their observations to the agency on November 9 and followed up by contacting the state attorney general’s office. By the following week, Banbreach had received acknowledgment and requests for assurances about not misusing the data and destroying the data.