HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Empire Fidelity Investments Life Insurance Company

bd_1ac32f968bc770ad · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 1, 2023

Filed

Mar 18, 2024

To disclose

20 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

63%

Full breach record for Empire Fidelity Investments Life Insurance Company →2 incidents on file

Fidelity Investments Life Insurance Company and Empire Fidelity Investments Life Insurance Company notified customers of a cybersecurity event at third-party provider Infosys McCamish, LLC. Between Oct 29 and Nov 2, 2023, an unauthorized party accessed IMS systems, likely exfiltrating names, SSNs, bank account/routing numbers, and dates of birth. The incident did not impact FILI/EFILI networks directly. 24 months of credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 20 weeks / 138 days

Oct 29, 2023

Begins

Nov 1, 2023

Discovered

Mar 18, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Part of INFOSYS MCCAMISH SYSTEMS, LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Maine State AGbd_6a230510306768c32024-03-18Verified by operator
New Hampshire State AGbd_edd3fb4b6e68d5992024-03-22 · +4dVerified by operator
Maine State AGbd_0599d8427643f9fe2024-03-04 · +14dCandidate
California State AGbd_1b81b0d92a8605332024-03-01 · +17dVerified

Name: Empire Fidelity Investments Life Insurance Company
norm: empire fidelity investments life insurance
Domain: fidelity.com

Name: Empire Fidelity Investments Life Insurance Company
norm: empire fidelity investments life insurance
Domain: fidelity.com
Industry: Financial Servicesllm

Discovered: Nov 1, 2023
Breach occurred: Oct 29, 2023 – Nov 2, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Third party: via Infosys McCamish, LLC

During the incident: Engaged with IMS to understand the nature and scope of the incident
Conducted a manual review of our records to identify the individuals potentially affected
Remain engaged with IMS as they continue their investigation
Arranged for credit monitoring and identity restoration services for 24 months at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(138 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

California State AGMar 1 · first

Maine State AG+3d

Maine State AG+17d

California State AG+17d · this page

New Hampshire State AG+21d

Pattern: first filing Mar 1 (CA), last Mar 22 (NH) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-582636
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 18, 2024
Raw hash: fdf783ea86dca7deffc4807ac04ff1364134b3f854167e218aa9a65a120cc640

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEmpire Fidelity Investments Life Insurance Company

Victim entityEmpire Fidelity Investments Life Insurance Company

Incidentdiscovered Nov 1, 2023

Stated responseEngaged with IMS to understand the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov