HackingVulnerability ExploitData ExfiltratedTargetedPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Pension Benefit Information, LLC
bd_20a3b8416525341e · schema v1 · pii pii-v1
Full breach record for Pension Benefit Information, LLC →Pension Benefit Information, LLC (PBI) disclosed a data breach stemming from the MOVEit Transfer vulnerability exploited by an unauthorized third party on May 29-30, 2023. PBI, which provides audit and address research for Fidelity Investments, confirmed that an attacker downloaded data containing PII and government IDs. PBI patched servers, investigated, and is offering 24 months of credit monitoring. No specific total count was provided in the Vermont filing, though a Rhode Island attachment noted ~1,772 impacted residents.
Vermont clock⏱ VT AG >14 bday6 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 8 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (7) · sorted by filing gap
- bd_223e8c30e3bd391dDelaware State AGfiled 2023-07-10(2d gap)Verified
- bd_e732ff20c2386d79Vermont State AGfiled 2023-07-19(7d gap)Verified
- bd_4c50415a8827e689Oregon State AGfiled 2023-07-27(15d gap)Candidate
- bd_1885081c1d2bb691Hawaii State AGfiled 2023-07-28(16d gap)Verified
Show 3 more filings ↓Show fewer ↑up to 30d gap
- bd_27f033748566ecf2New Hampshire State AGfiled 2023-08-08(27d gap)Verified
- bd_7bdc23aedd0d2aaaHawaii State AGfiled 2023-08-08(27d gap)Candidate
- bd_7632da10b2361b23New Hampshire State AGfiled 2023-08-11(30d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-07-12-pension-benefit-information-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 12, 2023
- Raw hash
- 7260110e61d3a8be79c8184c9526634dc83d2bd01b54fa604c1987e7de553653
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Jul 12, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Third party
- via Progress Software
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 6 weeks(42 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.