HackingFinancial ServicesFinanceVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDCriticalActive

HARTFORD LIFE and ACCIDENT INSURANCE COMPANY

bd_016026f131a68cb6 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 3, 2023

Filed

Aug 4, 2023

To disclose

9 weeks

Affected · nationwide

983,93117,839 in this filing

Linked

5 filings

Confidence

70%

Full breach record for HARTFORD LIFE and ACCIDENT INSURANCE COMPANY →6 incidents on file

Supplemental notice for Hartford Life and Accident Insurance Company regarding a breach involving vendor PBI Research Services. A threat actor exploited a zero-day vulnerability in MOVEit Transfer software to access data between May 29-30, 2023. The incident exposed names, SSNs, and DOBs of approximately 983,931 individuals, including 17,839 Washington residents. PBI patched the vulnerability, engaged forensic investigators, and notified law enforcement.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d9 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 5 days

discovery → filing · 9 weeks / 62 days

May 29, 2023

Begins

Jun 3, 2023

Discovered

Aug 4, 2023

Filed

vs. sector median

on median

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_84608f8881d861872023-08-04Verified
South Carolina State AGbd_cf150ea653feaa0d2023-08-04Verified
Oregon State AGbd_eac00102e231d3a12023-08-04Verified
Massachusetts State AGbd_56713c903d2623ec2023-08-03 · +1dVerified

Name: LOCKE LORD LLP
norm: locke lord

Name: HARTFORD LIFE and ACCIDENT INSURANCE COMPANY
norm: hartford life and accident insurance
Industry: Financial Servicesllm

Discovered: Jun 3, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 4, 2023
Affected individuals: 983,931state + nationwide
Data types: Identity (basic)Government ID
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: PBI reported the fraudulent activity to the Federal Bureau of InvestigationsThe Hartford will be notifying regulators in other states as required
Initial access: exploit_public_facing

During the incident: PBI installed the required security patches to remediate the vulnerability
PBI conducted its own forensics investigation
PBI engaged an independent forensics firm to confirm that there was no further impact
PBI enhanced its safeguards for data, including setting new rules for deletion of data
PBI reported the fraudulent activity to the Federal Bureau of Investigations
PBI is sending breach notification letters to the affected individuals
PBI is offering credit monitoring and identity theft protection services for twenty-four (24) months
Changes made: PBI enhanced its safeguards for data, including setting new rules for deletion of data from its instance of the software
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Massachusetts State AGAug 3 · first

Indiana State AG+1d

South Carolina State AG+1d

Oregon State AG+1d

Washington State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15453.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2023
Raw hash: 5853f670e0d4bbb85811e178a6c4d7e44208b569c750711df16dff04ecb86365

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityLOCKE LORD LLP

Victim entityHARTFORD LIFE and ACCIDENT INSURANCE COMPANY

Incidentdiscovered Jun 3, 2023

Stated responsePBI installed the required security patches to remediate the vulnerability

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com