Incident BriefingsQuoteWizard / LendingTree security incident

QuoteWizard / LendingTree security incident

Stolen credentials were used against a Snowflake customer account that did not enforce MFA. Customer data exposed.

Last modified

Summary

  • Environment: Insurance/Finance
  • Operational impact: Customer data exposed
  • Financial impact: No financial figure is established by the reviewed source evidence
  • Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.

What happened

In 2024, QuoteWizard experienced an incident in its insurance/finance environment. The retained source describes the attack path as follows: Stolen credentials were used against a Snowflake customer account that did not enforce MFA. [1]

The documented consequence was: Customer data exposed. [1]

Impact

  • Documented impact: Customer data exposed. [1]
  • No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.

Threat Group & Attack Vector

The retained source describes the attack path as follows: Stolen credentials were used against a Snowflake customer account that did not enforce MFA. The canonical record does not add intrusion steps beyond those supported by the source. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.

This account is bounded to Snowflake data security breach litigation. Details absent from that evidence are left unresolved rather than inferred. [1]