HackingStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNTCriticalContained
MILLIMAN, INC.
bd_2c4f45cb4ab5648d · schema v1 · pii pii-v1
Full breach record for MILLIMAN, INC. →Milliman, a professional services firm, disclosed a data breach affecting approximately 100,000 Vermont consumers. The incident resulted from a supply-chain compromise of Progress Software's MOVEit transfer application. Attackers exploited the vulnerability to exfiltrate customer data, including names, Social Security numbers, and financial account information. Milliman engaged forensic investigators and offered 24 months of credit monitoring to affected individuals.
Vermont clock✗ VT AG >45 bday24 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_3fef9efdde8291dcMaine State AGfiled 2024-01-12Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2024-01-12-milliman-data-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 12, 2024
- Raw hash
- 82cf2dee2c73279eaf8d81997c7ceca0590e31089ba976ba6fb0834a7c15ee43
Reporting entity
- Name
- MILLIMAN, INC.norm: milliman
Victim entity
- Name
- MILLIMAN, INC.norm: milliman
Incident
- Discovered
- Jul 28, 2023
- Materiality determined
- Jan 12, 2024
- Notification sent
- —
- Affected individuals
- 100,000
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain Compromise
- Threat actor
- ExternalFinancial
- Initial access
- supply_chain
Compliance
- Time to disclose
- 24 weeks(168 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.