HackingFinancial ServicesFinanceData ExfiltratedTargetedIdentity (basic)Government IDMediumContained

Mutual of America Life Insurance Co.

bd_1b8a78c48dfae39f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2025

Filed

Mar 23, 2026

To disclose

16 weeks

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for Mutual of America Life Insurance Co. →3 incidents on file

Mutual of America Life Insurance Co. reported an external system breach (hacking) where files were accessed/copied without authorization between Nov 14-29, 2025. Suspicious activity was discovered on Nov 29, 2025. The incident involved names and Social Security numbers. Two Maine residents were notified on March 23, 2026. The company engaged third-party specialists, notified law enforcement, and provided 12 months of Experian credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Nov 29, 2025 → Filed with AG Mar 23, 2026114d ⏱ ME AG >30d16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 15 days

discovery → filing · 16 weeks / 114 days

Nov 14, 2025

Begins

Nov 29, 2025

Discovered

Mar 23, 2026

Filed

vs. sector median

+8 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Indiana State AGbd_3562689e02180dbb2026-03-23Candidate
New Hampshire State AGbd_a2f0c72124367ded2026-03-23Verified
Massachusetts State AGbd_b2b2000549a544942026-03-23Verified

Name: Mutual of America Life Insurance Co.
norm: mutual of america life insurance
Domain: mutualofamerica.com
Industry: Financial Services

Name: Mutual of America Life Insurance Co.
norm: mutual of america life insurance
Domain: mutualofamerica.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Nov 29, 2025
Breach occurred: Nov 14, 2025 – Nov 29, 2025
Undetected for: 15 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 23, 2026
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified federal law enforcementProviding written notice of this incident to relevant state regulators
Initial access: exploit_public_facing

During the incident: Launched an investigation with third party specialists
Notified federal law enforcement
Provided access to credit monitoring services for twelve (12) months, through Experian
Provided impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this incident to relevant state regulators
Providing written notice to the three major credit reporting agencies
Changes made: Implement additional safeguards and training to its employees
Enhanced its existing security protocols
Continues to evaluate its policies and procedures related to data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(114 days from discovery to filing)
Compliance flags: ME AG >30d · 114d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Nov 29, 2025
→ Filed with AG: Mar 23, 2026
114d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Nov 29, 2025 → Filed with AG: Mar 23, 2026	114d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGMar 23 · first

New Hampshire State AGMar 23 · first

Massachusetts State AGMar 23 · first

Maine State AGMar 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/dff707b6-928a-407d-ac5b-039c8547bb16.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: f2736d080b4e5378416bc058c236fdbd92aa032079616127bdbc2a5d5506a04e

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMutual of America Life Insurance Co.

Victim entityMutual of America Life Insurance Co.

Incidentdiscovered Nov 29, 2025

Stated responseLaunched an investigation with third party specialists

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov