Social EngineeringFinancial ServicesFinancePhishingCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Pacific Guardian Life Insurance Company, Limited

bd_33e3d3efb681ddbf · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 5, 2023

Filed

Apr 4, 2024

To disclose

30 weeks

Affected

116state residents only

Linked

8 filings

Confidence

66%

Full breach record for Pacific Guardian Life Insurance Company, Limited →3 incidents on file

Pacific Guardian Life Insurance Company, Limited (PGL) notified New Hampshire residents of a cybersecurity incident. PGL identified suspicious email activity on September 5, 2023, and determined an unauthorized actor accessed data on August 25, 2023. The incident involved personal information of 116 NH residents. PGL engaged outside cybersecurity specialists, notified federal law enforcement, and provided credit monitoring services. No evidence of misuse was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 11 days

discovery → filing · 30 weeks / 212 days

Aug 25, 2023

Begins

Sep 5, 2023

Discovered

Apr 4, 2024

Filed

vs. sector median

+21 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_0fc2db7072413d002024-04-04Verified
Montana State AGbd_0fe8f27d24d745432024-04-04Candidate
Maine State AGbd_4057c1c6ac2e5bcf2024-04-04Candidate
Washington State AGbd_412bf12d74e777ab2024-04-04Verified

Show 3 more filings ↓up to 1d gap

Oregon State AGbd_8bfd1abd4f1e36072024-04-04Verified
Massachusetts State AGbd_b2e2a008244d1bca2024-04-04Verified
Indiana State AGbd_0113f0c501e684362024-04-05 · +1dVerified

Name: Pacific Guardian Life Insurance Company, Limited
norm: pacific guardian life insurance

Name: Pacific Guardian Life Insurance Company, Limited
norm: pacific guardian life insurance
Industry: Financial Servicesllm

Discovered: Sep 5, 2023
Breach occurred: Aug 25, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2024
Affected individuals: 116state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: External
Regulator citations: notified federal law enforcement regarding the eventproviding written notice of this event to relevant state regulators, as necessary
Initial access: phishing_link

During the incident: Initiated an investigation with the assistance of outside cybersecurity specialists
Notified federal law enforcement regarding the event
Working to implement additional safeguards and training to its employees
Providing access to credit monitoring services for individuals whose personal information was potentially affected by this event, at no cost to these individuals
Providing written notice of this event to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Secured our environment and investigated to determine the nature and scope of the incident
Continue to implement additional technical safeguards to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGApr 4 · first

Montana State AGApr 4 · first

Maine State AGApr 4 · first

Washington State AGApr 4 · first

Oregon State AGApr 4 · first

Massachusetts State AGApr 4 · first

New Hampshire State AGApr 4 · first · this page

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/pacific-guardian-life-insurance-20240404.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2024
Raw hash: 93481b2f2d93985a0d2d2ad3850c7d3d8d737a9005ad84abb23f4f582c6228fb

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityPacific Guardian Life Insurance Company, Limited

Victim entityPacific Guardian Life Insurance Company, Limited

Incidentdiscovered Sep 5, 2023

Stated responseInitiated an investigation with the assistance of outside cybersecurity specialists

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov