HackingVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Pension Benefit Information, LLC
bd_446f6dca6655bc6e · schema v1 · pii pii-v1
Full breach record for Pension Benefit Information, LLC →Pension Benefit Information, LLC (PBI) notified the New Hampshire Attorney General of a cybersecurity incident involving MOVEit Transfer software. An unauthorized third party exploited a vulnerability in MOVEit to access PBI's transfer servers on May 29-30, 2023, downloading data. PBI discovered the vulnerability around May 31, 2023. The incident affected 15 New Hampshire residents associated with the I.A.T.S.E. Staff Retirement and National Pension Funds. PBI patched servers, conducted manual reviews, and offered credit monitoring services.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_0cfce55dc81593cdVermont State AGfiled 2024-03-22Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/i-a-t-s-e-staff-retirement-national-pension-fund-pension-benefit-info-20240322.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 22, 2024
- Raw hash
- 6d251b2de5eae8362f51036b30753dd1f76263aeb3ef5aa2e470521cfb57f54e
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- Jul 7, 2023
- Notification sent
- Sep 21, 2023
- Affected individuals
- 15
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified Attorney General John Formella
- Third party
- via Progress Software (MOVEit Transfer)
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 42 weeks(296 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.