MalwareFinancial ServicesTechnologyFinanceRansomwareVulnerability ExploitSupply Chain (3P Vendor)Data EncryptedData ExfiltratedMulti-Stage ChainCustomer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)CVE-2021-44228HighContained

HERITAGE LIFE INSURANCE COMPANY

bd_32fe7e85d055dc7c · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 12, 2022

Filed

Jul 8, 2022

To disclose

17 weeks

Affected · nationwide

58,144303 in this filing

Linked

8 filings

Confidence

67%

Full breach record for HERITAGE LIFE INSURANCE COMPANY →3 incidents on file

Heritage Life Insurance Company submitted a supplemental notice to the Washington AG regarding a ransomware incident at its former IT provider, Inline Network Integration, LLC. The attack exploited Log4Shell (CVE-2021-44228) on March 11, 2022. Encrypted servers contained PII including SSNs, names, driver's licenses, financial accounts, and medical info for 58,144 individuals. 303 Washington residents were notified in this supplemental mailing on October 25, 2022.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d17 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 1 days

discovery → filing · 17 weeks / 118 days

Mar 11, 2022

Begins

Mar 12, 2022

Discovered

Jul 8, 2022

Filed

vs. sector median

+9 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_7cced443f4d63d322022-07-08Candidate
Maine State AGbd_7bf68d72b35a29522022-07-07 · +1dCandidate
Massachusetts State AGbd_10a2163a454958b52022-07-14 · +6dVerified
California State AGbd_4b9699f3bfd93e352022-07-14 · +6dVerified

Show 3 more filings ↓up to 6d gap

Indiana State AGbd_8be92c67804847282022-07-14 · +6dVerified
Montana State AGbd_de282c076ab825242022-07-14 · +6dVerified
Oregon State AGbd_ed52f06bbb2c84e12022-07-14 · +6dVerified

Name: HERITAGE LIFE INSURANCE COMPANY
norm: heritage life insurance

Name: HERITAGE LIFE INSURANCE COMPANY
norm: heritage life insurance
Industry: Financial ServicesllmTechnologyllm

Discovered: Mar 12, 2022
Breach occurred: Mar 11, 2022 – Apr 14, 2022
Undetected for: 1 dayoccurrence → discovery
Materiality determined: Jul 8, 2022
Notification sent: Oct 25, 2022
Affected individuals: 58,144state + nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
Data elements: NameSocial Security number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoing
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney GeneralContacted US Secret Service (USSS)
Third party: via Inline Network Integration, LLC
Initial access: exploit_public_facing
CVE references: CVE-2021-44228

During the incident: Terminated contract with Inline
Migrated to a new IT service provider, Managed Services Solutions
Engaged forensic investigators
Contacted law enforcement (US Secret Service)
Notified regulators
Mailed notification letters to affected individuals
Offered complimentary identity theft and credit monitoring
Changes made: Migrated to a new IT service provider
Contractual guarantees for security measures with new provider
New provider to obtain ISO 27001 certification
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Maine State AGJul 7 · first

Maine State AG+1d

Washington State AG+1d · this page

Massachusetts State AG+7d

California State AG+7d

Indiana State AG+7d

Montana State AG+7d

Oregon State AG+7d

Pattern: first filing Jul 7 (ME), last Jul 14 (OR) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA12601.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 8, 2022
Raw hash: 17efb2abe94eb8912fc31c181d18ca0472f5c65a2d1e22b76b9473697fa98c8a

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityHERITAGE LIFE INSURANCE COMPANY

Victim entityHERITAGE LIFE INSURANCE COMPANY

Incidentdiscovered Mar 12, 2022

Stated responseTerminated contract with Inline

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com