CRB Group, Inc.

The Maine Office of the Attorney General disclosed a data breach affecting CRB Group, Inc. on August 21, 2024. The incident stemmed from an external system breach that occurred between December 25, 2023, and January 3, 2024, though it was only detected on May 29, 2024. The breach compromised the personal information of approximately 1,198 individuals, including 4 residents of Maine. While the exact nature of the exposed data was not detailed in the report, the scale and regulatory notification suggest the leak involved sensitive personal or employee-related information. The delayed discovery—nearly five months after the initial intrusion—highlights potential vulnerabilities in CRB Group’s cybersecurity monitoring and response protocols. The breach’s impact appears confined to data exposure rather than financial fraud, operational disruption, or ransomware demands, but the involvement of an external system compromise indicates a targeted or opportunistic cyber attack. As a regulated disclosure, the incident underscores compliance risks under data protection laws, though no immediate evidence suggests broader systemic damage to the company’s operations or reputation beyond the mandatory breach notification and affected individuals’ potential exposure to identity theft or phishing risks.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a480d08f-0d45-4874-897e-d8b41bccbf6e.html

TPRM report: https://www.rankiteo.com/company/crb-consulting

"id": "crb005091825",
"linkid": "crb-consulting",
"type": "Breach",
"date": "12/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 1198,
                        'name': 'CRB Group, Inc.',
                        'type': 'Organization'}],
 'data_breach': {'number_of_records_exposed': 1198},
 'date_detected': '2024-05-29',
 'date_publicly_disclosed': '2024-08-21',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving CRB Group, Inc. The breach was discovered on '
                'May 29, 2024, after an external system breach occurring '
                'between December 25, 2023, and January 3, 2024. Approximately '
                '1,198 individuals were affected, including 4 residents of '
                'Maine.',
 'impact': {'data_compromised': True},
 'references': [{'date_accessed': '2024-08-21',
                 'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': [{'authority': 'Maine '
                                                                      'Office '
                                                                      'of the '
                                                                      'Attorney '
                                                                      'General',
                                                         'date': '2024-08-21'}]},
 'title': 'Data Breach at CRB Group, Inc.',
 'type': 'Data Breach'}