HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedGovernment IDIdentity (basic)MediumContained

The Global Atlantic Financial Group LLC

bd_015fbc1ff94f7b26 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 29, 2023

Filed

Sep 14, 2023

To disclose

15 weeks

Affected

0scope not determined

Linked

5 filings

Confidence

66%

Full breach record for The Global Atlantic Financial Group LLC →7 incidents on file

Pension Benefit Information, LLC (PBI) notified Global Atlantic Financial Group policyholders in Hawaii of a data breach involving the MOVEit Transfer software vulnerability. The incident occurred May 29-30, 2023, when an unauthorized third party accessed a PBI server and downloaded data. Approximately 124 Hawaii residents were affected. PBI patched servers, investigated, and offered credit monitoring. No identity theft was confirmed.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 108 days

May 29, 2023

Begins

May 29, 2023

Discovered

Sep 14, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 5 about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_017dc421aa010bff2023-08-08 · +37dVerified
Massachusetts State AGbd_5a405b4a1cd3139a2023-08-08 · +37dVerified
Washington State AGbd_d6b173a65da2adf52023-07-28 · +48dCandidate
Indiana State AGbd_ec0c41bc3c39285a2023-07-28 · +48dVerified

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com

Name: The Global Atlantic Financial Group LLC
norm: the global atlantic financial
Domain: globalatlantic.com
Industry: Financial Servicesllm

Discovered: May 29, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 18, 2023
Affected individuals: 0
Data types: Government IDIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Patched servers
Investigate
Assess the security of our systems
Notify potentially affected customers and individuals
Reviewing and enhancing our information security policies and procedures
Offering you access to ## months of complimentary credit monitoring and identity restoration services through Experian
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(108 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Washington State AGJul 28 · first

Indiana State AGJul 28 · first

Oregon State AG+11d

Massachusetts State AG+11d

Hawaii State AG+48d · this page

Pattern: first filing Jul 28 (WA), last Sep 14 (HI) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/2023-1048.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 14, 2023
Raw hash: 5f7ff627f32d5a04e722da3e0d547dfaf5802e4b4ef947ed6b7c953ee73eb87e

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityPension Benefit Information, LLC

Victim entityThe Global Atlantic Financial Group LLC

Incidentdiscovered May 29, 2023

Stated responsePatched servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov