AccidentalFinancial ServicesFinanceMisconfigurationCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)CredentialsHighContained

THE LINCOLN NATIONAL LIFE INSURANCE COMPANY

bd_4ade22be02212372 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 26, 2010

Filed

Jul 16, 2010

To disclose

20 weeks

Affected

26,840

Confidence

66%

Full breach record for THE LINCOLN NATIONAL LIFE INSURANCE COMPANY →31 incidents on file

Lincoln National Life Insurance Co. notified NH AG of a misconfiguration where a username/password for a secure vendor site was printed in an agent brochure and posted on agent websites. Incident discovered Feb 26, 2010. ~26,840 individuals affected (158 NH residents). Data included names, SSNs, health info. No evidence of unauthorized access found. Remediation included disabling creds, engaging Mandiant, and offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 452 days

discovery → filing · 20 weeks / 140 days

Dec 1, 2008

Begins

Feb 26, 2010

Discovered

Jul 16, 2010

Filed

vs. sector median

+12 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed26,840 affectedView incident

Name: Edwards Angell Palmer & Dodge
norm: edwards angell palmer dodge

Name: THE LINCOLN NATIONAL LIFE INSURANCE COMPANY
norm: the lincoln national life insurance
Industry: Financial Servicesllm

Discovered: Feb 26, 2010
Breach occurred: Dec 1, 2008
Undetected for: 452 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 20, 2010
Affected individuals: 26,840state + nationwide
Data types: Identity (basic)Government IDHealth (basic)Credentials
Attack vector: Misconfiguration
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Regulator citations: Notified New Hampshire Attorney General Michael A. Delaney
Initial access: valid_credentials

During the incident: The username and password were disabled
Engaged Mandiant to assist with the investigation
Removed the log-on credentials from the brochure
Removed the image of the brochure from the agent's website
Modified the brochure to remove the username and password
Changes made: Heightened enforcement of the existing Company policy that prohibits the sharing of usernames and passwords
Offered free credit monitoring services and identity theft consultation and restoration services through Kroll
Continually strengthening computer security policies and procedures across all information technology platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(140 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/lincoln-life-20100716.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 16, 2010
Raw hash: 2eb7c82071dbb2a0f6e02cc769d34edd8db1431a97d2056df015058339ed8f35

Reporting entityEdwards Angell Palmer & Dodge

Victim entityTHE LINCOLN NATIONAL LIFE INSURANCE COMPANY

Incidentdiscovered Feb 26, 2010

Stated responseThe username and password were disabled

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov