Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes (review confirmed breach on 2025-10-06), and remediation measures with public notice (website & mail notifications), remediation measures with offer of free credit monitoring (experian identityworks), and communication strategy with website notice (2025-10-29), communication strategy with mail notifications to affected clients, communication strategy with regulatory disclosures (maine & massachusetts ags)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Employee Email Account (Phishing).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii), Financial Information, Health-Related Information, Authentication Credentials and .

Incident Response Plan: The company's incident response plan is described as Yes (Review Confirmed Breach on 2025-10-06).

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Public Notice (Website & Mail Notifications), Offer of Free Credit Monitoring (Experian IdentityWorks), .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential Class Action Lawsuit (Under Investigation by Shamis & Gentile P.A.).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Roger Keith & Sons Insurance Agency - Data Security Incident NoticeDate Accessed: 2025-10-29, and Source: Shamis & Gentile P.A. - Class Action Investigation.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Website Notice (2025-10-29), Mail Notifications To Affected Clients and Regulatory Disclosures (Maine & Massachusetts Ags).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public Website Notice, Mail Notifications To Affected Clients, Credit Monitoring Enrollment (Experian Identityworks), Fraud Alert Placement, Regular Account Monitoring, Legal Rights Consultation and .

Last Attacking Group: The attacking group in the last incident was an Unauthorized Actor (Unknown).

Most Recent Incident Detected: The most recent incident detected was on 2025-01-27.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-29.

Most Significant Data Compromised: The most significant data compromised in an incident were First and last name, Date of birth, Social Security number, Driver's license number, Passport number, Military or other U.S. government-issued identification number, Mother's maiden name, Credit or debit card number (with access information), Financial account number (with access information), Username and password, Limited health-related information and .

Most Significant System Affected: The most significant system affected in an incident was Employee Email AccountNetwork Environment (via Remote Desktop Tool).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Credit or debit card number (with access information), Mother's maiden name, Limited health-related information, Driver's license number, First and last name, Social Security number, Financial account number (with access information), Passport number, Military or other U.S. government-issued identification number, Date of birth and Username and password.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 0.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential Class Action Lawsuit (Under Investigation by Shamis & Gentile P.A.).

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enroll in free credit monitoring (Experian IdentityWorks), Request free annual credit reports from major bureaus, Place a fraud alert on credit reports, Monitor financial statements for suspicious activity and Seek legal counsel for potential compensation.

Most Recent Source: The most recent source of information about an incident are Shamis & Gentile P.A. - Class Action Investigation and Roger Keith & Sons Insurance Agency - Data Security Incident Notice.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Class Action Lawsuit Investigation by Shamis & Gentile P.A.).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Public Website Notice, Mail Notifications to Affected Clients, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Credit monitoring enrollment (Experian IdentityWorks)Fraud alert placementRegular account monitoringLegal rights consultation.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Employee Email Account (Phishing).