HackingProfessional ServicesProfessional ServicesStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)LowContained

Pension Benefit Information, LLC

bd_2b476a800589524e · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Aug 16, 2023

To disclose

11 weeks

Affected

Not disclosed

Linked

46 records

Confidence

66%

Full breach record for Pension Benefit Information, LLC →3 incidents on file

Pension Benefit Information, LLC (PBI) issued a supplemental notice regarding a MOVEit Transfer vulnerability exploited by an unauthorized third party. The incident occurred on May 29-30, 2023, involving the exfiltration of names and data elements from a PBI server. PBI patched servers, investigated, and offered credit monitoring. No identity theft was confirmed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 77 days

May 29, 2023

Begins

May 31, 2023

Discovered

Aug 16, 2023

Filed

vs. sector median

9 wks faster

This filing is one of 46 records about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Vermont State AGbd_00fe2e9a4aff52802023-08-24 · +8dVerified by operator
Maine State AGbd_07101c97c9594fc42023-08-24 · +8dVerified by operator
Washington State AGbd_44f7fcad123559952023-08-24 · +8dVerified by operator
Maine State AGbd_4546a76555186a092023-08-24 · +8dVerified by operator

Show 6 more filings ↓up to 37d gap

Massachusetts State AGbd_4884e0e283db90b42023-08-24 · +8dVerified by operator
Vermont State AGbd_ed5751101a0d93ee2023-08-25 · +9dVerified
South Carolina State AGbd_fbf59513778aef8b2023-08-25 · +9dVerified by operator
California State AGbd_a1e18d6a91a9c2642023-09-18 · +33dVerified by operator
California State AGbd_83b0b7e92e935f832023-09-19 · +34dVerified by operator
New Hampshire State AGbd_37d305ef794986a72023-09-22 · +37dVerified by operator

Showing first 10 of 45 linked disclosures.

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com
Industry: Professional Servicesllm

Discovered: May 31, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Initial access: supply_chain

During the incident: Patched servers
Investigate
Assess the security of our systems
Notify potentially affected customers and individuals
Reviewing and enhancing our information security policies and procedures
Offering you access to 12/24 months of complimentary credit monitoring and identity restoration services through Kroll
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(77 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Delaware State AGAug 16 · first · this page

Vermont State AG+8d

Maine State AG+8d

Washington State AG+8d

Maine State AG+8d

Massachusetts State AG+8d

Vermont State AG+9d

South Carolina State AG+9d

California State AG+33d

California State AG+34d

New Hampshire State AG+37d

Pattern: first filing Aug 16 (DE), last Sep 22 (NH) — a 37-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 45 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/08/PBI-Supplemental-Notice-of-Data-Event.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 16, 2023
Raw hash: 014480532b0af98700d81c4a0de6270d9a70920192ff48765fdf00b457c317a0

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPension Benefit Information, LLC

Victim entityPension Benefit Information, LLC

Incidentdiscovered May 31, 2023

Stated responsePatched servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov