HackingFinancial ServicesTechnologyFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPHIGovernment IDIdentity (basic)Health (basic)EmploymentFinancial accountMediumContained

Massachusetts Mutual Life Insurance Company

bd_1f7599ca1a34a278 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 25, 2024

Filed

Aug 15, 2024

To disclose

20 weeks

Affected

3state residents only

Linked

2 filings

Confidence

67%

Full breach record for Massachusetts Mutual Life Insurance Company →48 incidents on file

Massachusetts Mutual Life Insurance Company notified the Idaho Attorney General on August 15, 2024, of a security incident involving three Idaho residents. The breach originated from a third-party vendor partner of HealthEquity, a benefits administrator for MassMutual. Unauthorized access occurred via compromised vendor accounts, exposing names, SSNs, and health data. MassMutual and HealthEquity engaged forensic experts, reset credentials, and provided credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 20 weeks / 143 days

Mar 25, 2024

Discovered

Aug 15, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_0dcb3a6d707429462024-08-15Verified

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance
Industry: Financial ServicesllmTechnologyllm

Discovered: Mar 25, 2024
Materiality determined: —
Notification sent: Aug 15, 2024
Affected individuals: 3state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General's Office
Initial access: valid_credentials

During the incident: Engaged third-party experts to determine the nature and scope of the incident
Disabled all potentially compromised vendor accounts
Terminated all active sessions
Blocked all IP addresses associated with threat actor activity
Implemented a global password reset for the impacted vendor
Enhanced security and monitoring efforts, internal controls, and security posture
Provided free, 24-month subscription to Experian IdentityForce (MassMutual) / credit identity monitoring, insurance, and restoration services through Equifax (HealthEquity)
Changes made: Enhanced security and monitoring efforts
Strengthened internal controls
Improved security posture
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(143 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGAug 15 · first

Idaho State AGAug 15 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2024/08/08-15-2024-Massachusetts-Mutual-Life-Insurance-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 15, 2024
Raw hash: 289046a21d4065f838a6610978483df0bcfe3718567c38d148e25603263f0b66

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMassachusetts Mutual Life Insurance Company

Victim entityMassachusetts Mutual Life Insurance Company

Incidentdiscovered Mar 25, 2024

Stated responseEngaged third-party experts to determine the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov