{ "type": "bundle", "id": "bundle--f8ccfd3a-2cbe-51e1-80f0-87c87bed43df", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--ab9275e6-4c34-5e71-8daf-14051be3cb9f", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "org:d37c9753-776c-4144-9a6e-c09b27a880a6", "name": "Hippo Analytics", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--5d89e6f2-1026-59fd-8de1-5f48311b4be0", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "inc:1c25846e-96d6-4e86-ab65-51266a1424e4", "name": "Hippo insurance quote-tool data exposure" }, { "type": "incident", "spec_version": "2.1", "id": "incident--992f020f-a99f-593a-8a82-5facc86ca7a5", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "brh:b9a771f9-a34d-46ab-b9d9-7a75eae77738", "name": "Hippo insurance quote-tool data exposure" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2df8f0cb-e03e-5c03-8ef1-951d9de2eaf9", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:acaeb0c6-ca45-4da2-9781-ba622f7af042", "relationship_type": "affected-organization", "source_ref": "incident--5d89e6f2-1026-59fd-8de1-5f48311b4be0", "target_ref": "identity--ab9275e6-4c34-5e71-8daf-14051be3cb9f", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:cd4dc5d7-8148-4cce-9792-9248df425811", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6677f916-3a03-502a-8ea5-6c7270c66101", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:5e6fbbad-1664-44dd-a757-6003b2acce6e", "relationship_type": "resulted-in", "source_ref": "incident--5d89e6f2-1026-59fd-8de1-5f48311b4be0", "target_ref": "x-ally-event--0df03f12-1df7-5359-8e30-2bfca80ad011", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:2e877a06-9e9f-4dae-bbba-1609c0d80816", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--75467378-ef9b-5643-8129-11c40f256286", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:30db694e-d206-4e29-8eb3-39407801b4fa", "relationship_type": "resulted-in", "source_ref": "incident--5d89e6f2-1026-59fd-8de1-5f48311b4be0", "target_ref": "x-ally-event--baea3fee-6b2a-50e1-876d-130a2324e0ff", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:2ce12d74-b7ca-4aaf-9e88-213066361b7e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cc4f219a-6326-5093-8227-82c4ccf9bd94", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:d6923022-0628-4dde-b9f3-b58954cba508", "relationship_type": "resulted-in", "source_ref": "incident--5d89e6f2-1026-59fd-8de1-5f48311b4be0", "target_ref": "x-ally-event--51d3874a-6593-50d6-81de-a7d01398eda9", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:d9514801-336c-41a1-a81e-953ba2b9d2f4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--52f6d8cd-c76e-52dd-8bf6-2752cae1b604", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:fb8eb8bc-3738-4b80-be58-04332999b13e", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:9cd3fa5b-a83c-46ae-872e-a9f22c9652aa", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Hippo removed the affected public-facing functionality, deployed code changes and added controls. Its October 30 letter offered 12 months of identity protection." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--59e6a1af-2621-5609-8876-ff488436f35a", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:0ac0d21b-0cb4-4d3e-b099-2ba24813d911", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:b971029f-8fd7-4687-a92f-074c64f77fd0", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-10-30" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--651d095f-4e56-5060-8ba2-09c826410e75", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:4f398053-c698-4b4d-8931-e8c6f0873842", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:3ae293d3-0cc4-4317-b376-20fd8a3602a8", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-08-03" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--7da2abce-b07e-567f-875d-e9e2dc532a87", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:49b4f753-d9bc-42fa-acd4-6baea7ac30b8", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:69f687e3-62ed-4e0b-a448-fca2b6dbdd71", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Hippo Analytics identified suspicious use of its auto-insurance quote tool on August 3, 2026. Unidentified actors submitted information and may have viewed personal data returned by the prefill feature." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--92a7c016-2572-5f85-8ed3-a85989e64464", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:f49b1718-121d-4a17-bb51-11006893d6ae", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:6ccaa0dd-c75d-474a-aa25-df4e99493ae7", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-08-11" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--9ee69cc3-2567-5f60-8293-c98b2084ce0d", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:0268a7cb-fffa-4026-984f-3c97f8403ebe", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:fe9f427d-78c9-464f-a1ab-c23bebd346b2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-08-03" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--c9ffe91b-dbf5-57d9-8f33-87bb3578a7e8", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:ab25dc38-9f71-4a2e-8d5c-6b663c118389", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:c481ff8e-890c-44c5-a900-cae67094ed6d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The California notice identifies names and driver’s license numbers as potentially accessed. People without a relationship with Hippo could also be affected." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--ff71e973-1f6d-5162-8e72-e3ca06cc4ce8", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "clm:7bf0bf34-e460-45d0-a768-775a13b06d2f", "confidence": 100, "external_references": [ { "source_name": "Hippo Analytics", "url": "https://oag.ca.gov/system/files/ACPDRAFT%20Hippo%20-%20Individual%20Notification%20Template%20%28CA%20ONLY%29%20v2%20%283%29.pdf", "external_id": "cit:cb701f4d-c23f-4a78-ba1d-e2a0a07ae014", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:40bbd3aa203349dddb8e233115d59bf0a35550533e8e90c82891be7ed7cc376d" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "The investigation placed unauthorized activity between January 30, 2025, and August 11, 2026, when Hippo said the issue was fully remediated." } }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--0df03f12-1df7-5359-8e30-2bfca80ad011", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:8276daa6-1bfd-48e0-a5bc-86caa586a847", "name": "Issue fully remediated" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--51d3874a-6593-50d6-81de-a7d01398eda9", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:64552411-4c87-4fd5-af7c-56cf29e52a15", "name": "Suspicious quote-tool activity detected" }, { "type": "x-ally-event", "spec_version": "2.1", "id": "x-ally-event--baea3fee-6b2a-50e1-876d-130a2324e0ff", "created": "2026-11-05T14:19:24.167580+00:00", "modified": "2026-11-05T14:19:24.167580+00:00", "x_ally_original_id": "evt:42da5ae2-c425-4421-8528-ac49050f0a30", "name": "Notification letter dated" } ] }