Data Breach Notifications

Entity Information

  • Type of Organization: Other Commercial
  • Entity Name: Ethos Technologies Inc.
  • Street Address: 75 Hawthorne Street, Suite 2000
  • City: San Francisco
  • State, or Country if outside the US: California
  • Zip Code: 94105

Submitted By

  • Name: Tiana Demas
  • Title: Partner
  • Firm name (if different than entity): Cooley LLP
  • Telephone Number: 212-479-6560
  • Email Address: tdemas@cooley.com
  • Relationship to entity whose information was compromised: Attorney

Breach Information

  • Total number of persons affected (including residents): 13,300
  • Total number of Maine residents affected: 13
  • If the number of Maine residents exceeds 1,000, have the consumer reporting agencies been notified:
  • Date(s) Breach Occured: 07/15/2021 - 01/12/2022
  • Date Breach Discovered: 01/12/2022
  • Description of the Breach:
    • Other
    • If other, please specify: On January 12, 2022, Ethos learned that unauthorized actors had launched a sophisticated attack against the company’s online insurance application flow (the “Online Flow”). To do this, the unauthorized actors entered information they already had obtained from other sources—first and last name, address, date of birth, and driver’s license state—into the Online Flow. Then they used specialized web tools to access the corresponding driver’s license numbers (produced via a third-party integration) from the page source code of the Online Flow. Importantly, this information did not appear on the public-facing part of the website. While Ethos uses software and other methods designed to detect attacks against the Online Flow and the company’s systems more generally, the unauthorized actors used techniques that appear to have been designed to avoid detection. The unauthorized activity spanned from approximately July 15, 2021 to January 12, 2022.
  • Information Acquired - Name or other personal identifier in combination with: Driver's License Number or Non-Driver Identification Card Number

Notification and Protection Services

  • Type of Notification: Written
  • Date(s) of consumer notification: 02/11/2022
  • Copy of notice to affected Maine residents: L01 Template Individual Notice - FINAL.pdf
  • Date of any previous (within 12 months) breach notifications: None
  • Were identity theft protection services offered: Yes
  • If yes, please provide the duration, the provider of the service and a brief description of the service: 24 months; identity theft and credit monitoring service