Cyber Incident Victim: North American Risk Services
Date:
Feb 2018
Location:
United States of America
Summary
North American Risk Services, a Florida-based third-party claims administrator, experienced a data breach involving unauthorized access to employee email accounts over a multi-week period, compromising sensitive personal information of 604 California residents. The exposed data included names combined with Social Security numbers, driver’s license details, financial account information, medical records, health insurance data, taxpayer IDs, and login credentials. The company detected the incident through suspicious email activity and engaged a security investigator, but faced challenges locating contact details for affected individuals. Notification occurred in two phases after leveraging third-party address services to identify remaining victims. Impacted individuals were offered complimentary credit monitoring and identity restoration services for one year.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The North American Risk Services (NARS) data breach occurred between February 7 and March 27, 2018, impacting 604 California residents. The Florida-based third-party claims administrator detected the incident after observing suspicious emails originating from an employee's account. A subsequent investigation involving a security investigator revealed unauthorized access to a limited number of company email accounts during the two-month window. On June 27, 2018, the investigator confirmed these compromised emails contained sensitive personal information but initially lacked contact details for over 25% of affected individuals. The exposed data included victims' names combined with at least one of the following identifiers: Social Security numbers, driver's license numbers, financial account details, medical records, health insurance information, taxpayer/employer identification numbers, or login credentials.
NARS initiated a phased notification process beginning August 31 after establishing contact information for 50% of affected parties. The company cited the significant time required to locate remaining individuals as justification for the delayed notifications. For the unresolved 25% of cases, NARS employed a third-party address locator service that utilized Social Security numbers to identify physical mailing addresses, completing this process by September 7. A second notification wave was dispatched on October 5, 2018, reaching all confirmed victims. The breach exclusively affected California-based customers, with no evidence suggesting wider geographical impact. As remediation, NARS provided all 604 affected individuals with one year of complimentary credit monitoring and identity restoration services. The incident remained confined to email account compromises without reported lateral network movement or additional system infiltration.