HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Global Atlantic
bd_2fd32b32e3e18818 · schema v1 · pii pii-v1
Full breach record for Global Atlantic →The Global Atlantic Financial Group LLC notified California residents of a data breach involving a third-party vendor, Pension Benefits Information LLC (PBI). Cyber criminals exploited an unknown vulnerability in PBI's MOVEit file transfer application, accessing data on May 29-30, 2023. Global Atlantic was notified on June 7, 2023. The incident impacted policyholder data, including personal identifiable information. The company engaged experts, reported to authorities, and offered two years of Experian IdentityWorks to affected individuals.
California clockDiscovered Jun 7, 2023 → Notified Jul 28, 202351d ✓ CA 60-day OK10 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_996dba95423b3558Delaware State AGfiled 2023-07-28(17d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571816
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 14, 2023
- Raw hash
- c7f3aa8fee6d043f11fe1dadafbc701e65662cc96226cd2e378106bb1d658297
Reporting entity
- Name
- Global Atlanticnorm: global atlantic
- Domain
- globalatlantic.com
Victim entity
- Name
- Global Atlanticnorm: global atlantic
- Domain
- globalatlantic.com
Incident
- Discovered
- Jun 7, 2023
- Materiality determined
- —
- Notification sent
- Jul 28, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Reported the incident to the appropriate authorities
- Third party
- via Pension Benefits Information LLC
- Initial access
- supply_chain
Compliance
- Time to disclose
- 10 weeks(68 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 51d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 7, 2023→ Notified: Jul 28, 202351d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.