Breach taxonomy
Summary
On June 7, 2025, Erie Indemnity Company identified unusual network activity determined to be an information security event. The company activated incident response protocols, took immediate protective measures, notified law enforcement, and engaged third-party cybersecurity experts for forensic analysis. The full scope, nature, and impact of the event were not yet known as of filing date. Filed under Item 8.01; materiality not yet determined as of filing date.
Tagging rationale
ThreatUnknown
Filing does not attribute the incident to a specific actor → UNKNOWN.
MethodsMalware
Filing describes unusual network activity requiring containment and forensic analysis; no specific method confirmed → MALWARE (general network intrusion).
AssetsConfidential Biz
Filing describes unusual network activity at a major insurance company with no confirmed data access; corporate network/business systems implicated → CONFIDENTIAL-BIZ.
EffectsNetwork Security
No confirmed data access or operational disruption; only confirmed impact is the network security compromise requiring investigation → NETWORK-SECURITY.
Impact
Very early disclosure with no confirmed data access, no operational disruption, and no quantified impact; investigation ongoing → score 1.
InsuranceNot disclosed
Filing makes no mention of insurance → null.
Read the original SEC filing excerpt
Item 8.01 Other Events. Discovery of and Response to Information Security Event On June 7, 2025, Erie Indemnity Company (the "Company") identified unusual network activity, which the Company determined to be the result of an information security event. Upon learning of this activity, the Company activated its incident response protocols and took immediate action to respond to the situation to safeguard our systems. The Company also notified and is working with law enforcement. The Company continues to take protective measures, and is conducting forensic analysis with the assistance of leading third-party cybersecurity experts to gain a full understanding of this event. Given the recency of the event, the Company's investigation and response are ongoing, and the full scope, nature, and ultimate impact on the Company are not yet known.