HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
Pension Benefit Information, LLC
bd_31eb3a86b455ca2a · schema v1 · pii pii-v1
Full breach record for Pension Benefit Information, LLC →Pension Benefit Information, LLC (PBI) notified the California AG of a data breach involving its third-party software provider, Progress Software. An unauthorized third party exploited a vulnerability in Progress's MOVEit Transfer software, accessing PBI's servers on May 29-30, 2023, and downloading data. PBI discovered the incident on May 31, 2023, when Progress disclosed the vulnerability. Affected data includes names and other basic identity information. PBI has patched servers, investigated the scope, and is offering 24 months of credit monitoring via Kroll.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_88a232a96ae8d0e9New Hampshire State AGfiled 2023-08-24Verified
- bd_f52c76855c9e670bNew Hampshire State AGfiled 2023-08-24Verified
- bd_ed5751101a0d93eeVermont State AGfiled 2023-08-25(1d gap)Verified
- bd_5a81a9b3803e493cDelaware State AGfiled 2023-08-23(1d gap)Verified
Show 4 more filings ↓Show fewer ↑up to 41d gap
- bd_bc42d7fee9bd036cMaine State AGfiled 2023-08-16(8d gap)Candidate
- bd_8a9b6ba4c65dda36Delaware State AGfiled 2023-07-28(27d gap)Candidate
- bd_eb47f1a922c8d8ddDelaware State AGfiled 2023-07-17(38d gap)Candidate
- bd_729ad9694adf695eNew Hampshire State AGfiled 2023-07-14(41d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-572327
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 24, 2023
- Raw hash
- 06612b3ce6a5f1cfcbef5990084536df97180d1614782bd47b36d2cc97b49ade
Reporting entity
- Name
- NEW YORK LIFE INSURANCE COMPANYnorm: new york life insurance
Victim entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 12 weeks(85 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.