HackingFinancial ServicesFinanceData ExfiltratedCustomer Data InvolvedGovernment IDIdentity (basic)HighContained

NEW YORK LIFE INSURANCE COMPANY

bd_2275313f347a3b82 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 12, 2023

Filed

Aug 10, 2023

To disclose

8 weeks

Affected · nationwide

1,3673 in this filing

Linked

17 filings

Confidence

66%

Full breach record for NEW YORK LIFE INSURANCE COMPANY →26 incidents on file

New York Life Insurance Company reported an external system breach (hacking) occurring on May 29, 2023, discovered on June 12, 2023. The incident affected 1,367 individuals, including 3 Maine residents. Acquired data included names and Social Security Numbers. The company provided written notification and offered 12 months of Kroll Identity Monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jun 12, 2023 → Filed with AG Aug 10, 202359d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 14 days

discovery → filing · 8 weeks / 59 days

May 29, 2023

Begins

Jun 12, 2023

Discovered

Aug 10, 2023

Filed

vs. sector median

on median

This filing is one of 17 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_2d7083123064fe072023-08-21 · +11dVerified
New Hampshire State AGbd_c095bade2547bd452023-08-23 · +13dVerified
Massachusetts State AGbd_207dbe262e4777312023-08-24 · +14dVerified
Washington State AGbd_3e32b53431a6efda2023-08-24 · +14dVerified

Show 6 more filings ↓up to 74d gap

Maine State AGbd_bd81384556d7cb8e2023-08-24 · +14dVerified
Oregon State AGbd_fae5706e9cae755d2023-08-24 · +14dVerified
Indiana State AGbd_06461f26b87d049d2023-10-23 · +74dVerified
Massachusetts State AGbd_4fe1a5b57ca82e4b2023-10-23 · +74dVerified
Oregon State AGbd_8beaf5d613d1c2a92023-10-23 · +74dCandidate
Maine State AGbd_cff49122540e81702023-10-23 · +74dVerified

Showing first 10 of 16 linked disclosures.

Name: NEW YORK LIFE INSURANCE COMPANY
norm: new york life insurance
Domain: newyorklife.com
Industry: Financial Services

Name: NEW YORK LIFE INSURANCE COMPANY
norm: new york life insurance
Domain: newyorklife.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jun 12, 2023
Breach occurred: May 29, 2023
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 10, 2023
Affected individuals: 1,367state + nationwide
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Filed data breach notice with Maine Attorney General
Initial access: exploit_public_facing

During the incident: Sent written notification to affected individuals
Offered 12 months of Kroll Identity Monitoring services
Changes made: Offered 12 months of Kroll Identity Monitoring services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: ME AG >30d · 59d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jun 12, 2023
→ Filed with AG: Aug 10, 2023
59d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jun 12, 2023 → Filed with AG: Aug 10, 2023	59d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Maine State AGAug 10 · first · this page

Indiana State AG+11d

New Hampshire State AG+13d

Massachusetts State AG+14d

Washington State AG+14d

Maine State AG+14d

Oregon State AG+14d

Indiana State AG+74d

Massachusetts State AG+74d

Oregon State AG+74d

Maine State AG+74d

Pattern: first filing Aug 10 (ME), last Oct 23 (ME) — a 74-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 16 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/b5de2e74-bee0-4b8b-aa94-34892fe80c6c.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 10, 2023
Raw hash: d47bccaad5433475389e7705f58a1500bb4960383db22ca46b3afb7e9deda291

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityNEW YORK LIFE INSURANCE COMPANY

Victim entityNEW YORK LIFE INSURANCE COMPANY

Incidentdiscovered Jun 12, 2023

Stated responseSent written notification to affected individuals

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov