Social EngineeringFinancial ServicesHealthcareFinancePhishingStolen CredentialsTargetedData ExfiltratedIdentity (basic)Government IDFinancial accountHealth (basic)PHIHighContained

Pacific Guardian Life Insurance Company, Limited

bd_412bf12d74e777ab · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 5, 2023

Filed

Apr 4, 2024

To disclose

30 weeks

Affected

1,950state residents only

Linked

8 filings

Confidence

69%

Full breach record for Pacific Guardian Life Insurance Company, Limited →3 incidents on file

Pacific Guardian Life Insurance Company, Limited reported a phishing-based cyberattack on August 25, 2023, discovered on September 5, 2023. The incident compromised the personal and health information of 1,950 Washington residents, including names, SSNs, driver's licenses, financial account data, and medical information. The company engaged forensic specialists, notified law enforcement, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d30 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 11 days

discovery → filing · 30 weeks / 212 days

Aug 25, 2023

Begins

Sep 5, 2023

Discovered

Apr 4, 2024

Filed

vs. sector median

+21 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

California State AGbd_0fc2db7072413d002024-04-04Verified
Montana State AGbd_0fe8f27d24d745432024-04-04Candidate
New Hampshire State AGbd_33e3d3efb681ddbf2024-04-04Verified
Maine State AGbd_4057c1c6ac2e5bcf2024-04-04Candidate

Show 3 more filings ↓up to 1d gap

Oregon State AGbd_8bfd1abd4f1e36072024-04-04Verified
Massachusetts State AGbd_b2e2a008244d1bca2024-04-04Verified
Indiana State AGbd_0113f0c501e684362024-04-05 · +1dVerified

Name: Pacific Guardian Life Insurance Company, Limited
norm: pacific guardian life insurance

Name: Pacific Guardian Life Insurance Company, Limited
norm: pacific guardian life insurance
Industry: Financial ServicesllmHealthcarellm

Discovered: Sep 5, 2023
Breach occurred: Aug 25, 2023
Undetected for: 11 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 5, 2024
Affected individuals: 1,950state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)PHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Providing written notice of this event to relevant state regulators, as necessary
Initial access: phishing_link

During the incident: Initiated an investigation with the assistance of outside cybersecurity specialists
Notified federal law enforcement regarding the event
Providing access to credit monitoring services for 12 months, through IDX, to individuals whose personal information was potentially affected by this event, at no cost to these individuals
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Providing written notice of this event to relevant state regulators, as necessary, and to the three major credit reporting agencies, Equifax, Experian, and TransUnion
Changes made: Working to implement additional safeguards and training to its employees
Continue to implement additional technical safeguards to help prevent a similar incident in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 30 weeks(212 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

California State AGApr 4 · first

Montana State AGApr 4 · first

New Hampshire State AGApr 4 · first

Maine State AGApr 4 · first

Oregon State AGApr 4 · first

Massachusetts State AGApr 4 · first

Washington State AGApr 4 · first · this page

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28534.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 4, 2024
Raw hash: 48f8c72f35b370ebb2546c598bc32cfc1e8083d72bcbadc5f188e45de9cd0be3

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityPacific Guardian Life Insurance Company, Limited

Victim entityPacific Guardian Life Insurance Company, Limited

Incidentdiscovered Sep 5, 2023

Stated responseInitiated an investigation with the assistance of outside cybersecurity specialists

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com