Data Breach Notifications

Entity Information

  • Type of Organization: Other Commercial
  • Entity Name: Woodruff-Sawyer & Co.
  • Street Address: 50 California Street, Floor 12
  • City: San Francisco
  • State, or Country if outside the US: CA
  • Zip Code: 94111

Submitted By

  • Name: Vysali Soundararajan
  • Title: Corporate Counsel
  • Firm name (if different than entity):
  • Telephone Number: 415.399.6472
  • Email Address: vsoundararajan@woodruffsawyer.com
  • Relationship to entity whose information was compromised: Corporate Counsel

Breach Information

  • Total number of persons affected (including residents): 3087
  • Total number of Maine residents affected: 25
  • If the number of Maine residents exceeds 1,000, have the consumer reporting agencies been notified: Yes
  • Date(s) Breach Occured: 01/20/2024
  • Date Breach Discovered: 02/05/2024
  • Description of the Breach:
    • Other, External system breach (hacking)
    • If other, please specify: On January 20, 2024, a Woodruff Sawyer executive was victimized by a “SIM swapping” attack. An unknown individual went to a mobile carrier’s retail store and successfully convinced a store employee to transfer the phone number of one of our executives to another device. The unauthorized third party was then able to use our executive’s phone number to reset the executive’s work password and access some of our cloud systems. The unauthorized third party downloaded a subset of files accessible via the victim executive’s work account. The affected personal information is data that we receive from Woodruff’s corporate clients in connection with our provision of insurance brokerage and risk consulting services to those clients.
  • Information Acquired - Name or other personal identifier in combination with: Driver's License Number or Non-Driver Identification Card Number

Notification and Protection Services

  • Type of Notification: Written
  • Date(s) of consumer notification: 03/04/2024
  • Copy of notice to affected Maine residents: WOODRUFF-SAWYER & CO_L01_Sample.pdf
  • Date of any previous (within 12 months) breach notifications:
  • Were identity theft protection services offered: Yes
  • If yes, please provide the duration, the provider of the service and a brief description of the service: 24 months, Experian credit report at signup, Credit Monitoring, Identity Restoration, Up to $1 Million Identity Theft Insurance, Experian IdentityWorks ExtendCARE