Pension Benefit Information, LLC
bd_1117cd23d7ce5a7e · schema v1 · pii pii-v1
Full breach record for Pension Benefit Information, LLC →Pension Benefit Information, LLC (PBI) disclosed a data breach involving its MOVEit Transfer server. An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software to access PBI's server on May 29-30, 2023, downloading data. PBI discovered the incident around May 31, 2023. The breach affected approximately 91 New Hampshire residents affiliated with PBI's clients. Data involved likely included personal identifiers. PBI patched servers, engaged forensic review, and offered credit monitoring via Kroll. Notices were mailed starting August 16, 2023.
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_21deab48ee14b061Vermont State AGfiled 2023-08-03(1d gap)Verified
- bd_24b237c51e7cf240Oregon State AGfiled 2023-08-02(2d gap)Candidate
- bd_4ef4f5a2a6479be3Oregon State AGfiled 2023-07-31(4d gap)Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/pension-benefit-information-20230804.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 4, 2023
- Raw hash
- 9102396a45ebb7ba8ae487717212b094feb9c6a1da42b24d1b449fac777dbd50
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 16, 2023
- Affected individuals
- 91
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- providing written notice of this event to appropriate governmental regulators, as necessary
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(65 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.