HackingProfessional ServicesTechnologyProfessional ServicesVulnerability ExploitCapture Stored DataZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedPIIIdentity (basic)CVE-2023-34362LowContained

MILLIMAN, INC.

bd_0784ee17d069ca5f · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Aug 17, 2023

To disclose

11 weeks

Affected

335state residents only

Linked

10 filings

Confidence

65%

Full breach record for MILLIMAN, INC. →5 incidents on file

Milliman, Inc. notified the NH AG of a data breach involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer software was exploited via CVE-2023-34362 (zero-day) on May 29-30, 2023. An unauthorized actor downloaded data belonging to 335 New Hampshire residents. Milliman stopped data transfers to PBI and is enhancing vendor security. PBI patched the vulnerability and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 78 days

May 29, 2023

Begins

May 31, 2023

Discovered

Jul 21, 2023

Scope determined

Aug 17, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Maine State AGbd_ef7ad7a4aedf79b12023-08-18 · +1dVerified
California State AGbd_5fb2b809a54c9f682023-08-14 · +3dVerified
Indiana State AGbd_61914e30e6a7f2e72023-08-14 · +3dVerified
Massachusetts State AGbd_6f1acd087e5dc3602023-08-14 · +3dVerified

Show 5 more filings ↓up to 3d gap

Maine State AGbd_847189c2c427ed3b2023-08-14 · +3dCandidate
Washington State AGbd_b71e461fa51aa4b22023-08-14 · +3dVerified
Oregon State AGbd_c290a9c83b4262b52023-08-14 · +3dVerified
Idaho State AGbd_d1cb5766b2805d522023-08-14 · +3dVerified
Montana State AGbd_efdfa8d0534820d32023-08-14 · +3dVerified

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com
Industry: Professional ServicesllmTechnologyllm

Discovered: May 31, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: Jul 21, 2023
Notification sent: Aug 14, 2023
Affected individuals: 335state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed notice with New Hampshire Attorney General Consumer Protection Bureau
Third party: via Pension Benefit Information, LLC
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: Stopped transferring data to PBI pending further evaluation of PBI's information security practices
Evaluating potential vendor management and security enhancements
Providing written notification to affected individuals
Offering 24 months of complimentary credit monitoring and identity restoration services through Kroll
Changes made: PBI patched the vulnerability in its MOVEit Transfer software
PBI is reviewing and enhancing its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(78 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

California State AGAug 14 · first

Indiana State AGAug 14 · first

Massachusetts State AGAug 14 · first

Maine State AGAug 14 · first

Washington State AGAug 14 · first

Oregon State AGAug 14 · first

Idaho State AGAug 14 · first

Montana State AGAug 14 · first

New Hampshire State AG+3d · this page

Maine State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/milliman-20230817.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 17, 2023
Raw hash: 6e6831f52a383d04b21e48c70f4de15720af8ea379e55e834e74dd0e37c32d67

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMILLIMAN, INC.

Victim entityMILLIMAN, INC.

Incidentdiscovered May 31, 2023

Stated responseStopped transferring data to PBI pending further evaluation of PBI's information security practices

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov