HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
Massachusetts Mutual Life Insurance Company
bd_1f7599ca1a34a278 · schema v1 · pii pii-v1
Full breach record for Massachusetts Mutual Life Insurance Company →Massachusetts Mutual Life Insurance Company notified the Idaho Attorney General on August 15, 2024, of a security incident involving three Idaho residents. The breach originated from a third-party vendor partner of HealthEquity, a benefits administrator for MassMutual. Unauthorized access occurred via compromised vendor accounts, exposing names, SSNs, and health data. MassMutual and HealthEquity engaged forensic experts, reset credentials, and provided credit monitoring services.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3 affectedView incident
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2024/08/08-15-2024-Massachusetts-Mutual-Life-Insurance-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 15, 2024
- Raw hash
- 289046a21d4065f838a6610978483df0bcfe3718567c38d148e25603263f0b66
Reporting entity
- Name
- Massachusetts Mutual Life Insurance Companynorm: massachusetts mutual life insurance
Victim entity
- Name
- Massachusetts Mutual Life Insurance Companynorm: massachusetts mutual life insurance
Incident
- Discovered
- Mar 25, 2024
- Materiality determined
- —
- Notification sent
- Aug 15, 2024
- Affected individuals
- 3
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Idaho Attorney General's Office
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 20 weeks(143 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.