HackingFinancial ServicesHealthcareFinanceVulnerability ExploitStolen CredentialsData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)Financial accountMediumContained

Gerber Life Insurance Company

bd_49f3137f60325c13 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 23, 2023

Filed

Nov 17, 2023

To disclose

12 weeks

Affected

Not disclosed

Linked

3 filings

Confidence

65%

Full breach record for Gerber Life Insurance Company →6 incidents on file

Gerber Life Insurance Company notified the California AG of a data breach involving its service provider, MESVision. An unauthorized individual exploited a vulnerability in MESVision's MOVEit server to exfiltrate personal information (including SSNs and DOBs) of vision benefit plan enrollees on May 28 and May 31, 2023. MESVision discovered the incident on August 23, 2023. The server was taken offline, and a cybersecurity firm was engaged. Affected individuals are offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Aug 23, 2023 → Notified Nov 15, 202384d ✗ CA 60-day late12 weeks discovery → filing

Incident timeline

undetected · 87 days

discovery → filing · 12 weeks / 86 days

May 28, 2023

Begins

Aug 23, 2023

Discovered

Nov 17, 2023

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

South Carolina State AGbd_bae7da52e2dbc6dd2023-11-17Verified
Massachusetts State AGbd_cf3fcbeea7741b532023-11-17Verified

Name: Gerber Life Insurance Company
norm: gerber life insurance
Domain: gerberlife.com

Name: Gerber Life Insurance Company
norm: gerber life insurance
Domain: gerberlife.com
Industry: Financial ServicesllmHealthcarellm

Discovered: Aug 23, 2023
Breach occurred: May 28, 2023 – May 31, 2023
Undetected for: 87 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 15, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Reported the incident to the FBI
Third party: via MESVision
Initial access: exploit_public_facing

During the incident: Took the MOVEit server offline
Launched an investigation into the incident
Engaged a cybersecurity firm
Reported the incident to the FBI
Rebuilt the MOVEit system in accordance with MOVEit requirements
Undertook technical measures to confirm security protections before reactivating the system
Offering complimentary credit monitoring and identity restoration services through Kroll
Changes made: Rebuilt the MOVEit system in accordance with MOVEit requirements
Undertook technical measures to confirm security protections before reactivating the system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(86 days from discovery to filing)
Compliance flags: CA 60-day late · 84d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Aug 23, 2023
→ Notified: Nov 15, 2023
84d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Aug 23, 2023 → Notified: Nov 15, 2023	84d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

South Carolina State AGNov 17 · first

Massachusetts State AGNov 17 · first

California State AGNov 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-576675
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 17, 2023
Raw hash: 0136eb9188cd17f8d38713a5385398fbc61d82293f3ef675c751c8553ed641a5

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityGerber Life Insurance Company

Victim entityGerber Life Insurance Company

Incidentdiscovered Aug 23, 2023

Stated responseTook the MOVEit server offline

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov