HackingVulnerability ExploitData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Empire Fidelity Investments Life Insurance Company
bd_0599d8427643f9fe · schema v1 · pii pii-v1
Full breach record for Empire Fidelity Investments Life Insurance Company →Fidelity Investments Life Insurance reported a third-party system breach involving a software vulnerability at vendor Infosys McCamish Systems LLC. The incident occurred between October 29 and November 2, 2023, and was discovered on February 13, 2024. Approximately 28,268 individuals were affected, including 162 Maine residents. The breach exposed names and financial account numbers. Fidelity notified affected individuals in March 2024 and provided 24 months of credit monitoring through TransUnion.
Maine clockDiscovered Feb 13, 2024 → Filed with AG Mar 4, 202420d ✓ ME AG ≤30d20 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_1b81b0d92a860533California State AGfiled 2024-03-01(3d gap)Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/0c98c6d7-c7b3-4bbf-a7fa-8005c61168d6.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 4, 2024
- Raw hash
- e6d1cc685ce9652af0b17474c7474bc920ce8f9b3638e76804d0a5de92378f2b
Reporting entity
- Name
- Empire Fidelity Investments Life Insurance Companynorm: empire fidelity investments life insurance
- Domain
- fidelity.com
Victim entity
- Name
- Empire Fidelity Investments Life Insurance Companynorm: empire fidelity investments life insurance
- Domain
- fidelity.com
Incident
- Discovered
- Feb 13, 2024
- Materiality determined
- —
- Notification sent
- Mar 1, 2024
- Affected individuals
- 28,268
- Data types
- IDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 20 days(20 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 20d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Feb 13, 2024→ Filed with AG: Mar 4, 202420d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.