MalwareFinancial ServicesFinancePhishingRansomwareData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancialMediumContained

PAN-AMERICAN LIFE INSURANCE GROUP, INC.

bd_4c420d6a8894a3ff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 19, 2021

Filed

Mar 11, 2021

To disclose

20 days

Affected

Not disclosed

Linked

11 filings

Confidence

65%

Full breach record for PAN-AMERICAN LIFE INSURANCE GROUP, INC. →5 incidents on file

Pan-American Life Insurance Group experienced a data security incident detected on February 19, 2021, following a phishing attempt that resulted in malware installation. Unauthorized access occurred on February 16, 2021. The attacker exfiltrated personal information including names, addresses, dates of birth, and for a small percentage of individuals, more sensitive data such as Social Security numbers. The company took systems offline, engaged forensic experts, and offered credit monitoring to affected policyholders and beneficiaries.

J jump to incidentP pin to compareR raw source

California clockDiscovered Feb 19, 2021 → Notified Mar 11, 202120d ✓ CA 60-day OK20 days discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 20 days

Feb 16, 2021

Begins

Feb 19, 2021

Discovered

Mar 11, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_210f3813699a65032021-03-11Verified
Maine State AGbd_6ad9d6e594b013d22021-03-11Candidate
Oregon State AGbd_998b87a09ea02dbb2021-03-11Verified
Indiana State AGbd_b9faa419326142022021-03-11Verified

Show 6 more filings ↓up to 61d gap

Washington State AGbd_ffc6147672576b842021-03-11Verified
New Hampshire State AGbd_1b6f9b2256849ef72021-03-15 · +4dVerified
South Carolina State AGbd_3ae349d38c3488b52021-03-16 · +5dVerified
Maine State AGbd_20a55628c87f9f642021-04-07 · +27dVerified
Maine State AGbd_fd5d731d6a5e6baf2021-04-30 · +50dVerified
New Hampshire State AGbd_4c2efe11d52f8f372021-05-11 · +61dVerified

Name: PAN-AMERICAN LIFE INSURANCE GROUP, INC.
norm: pan american life insurance
Domain: palig.com

Name: PAN-AMERICAN LIFE INSURANCE GROUP, INC.
norm: pan american life insurance
Domain: palig.com
Industry: Financial Servicesllm

Discovered: Feb 19, 2021
Breach occurred: Feb 16, 2021
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 11, 2021
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security numberDate of birth
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: External
Initial access: phishing_link

During the incident: Took computer network offline
Engaged third-party cyber experts to partner with our team to launch an investigation
Established a dedicated call center to provide information
Offering a complimentary one-year subscription to Experian IdentityWorks Credit Monitoring and Identity Theft Protection
Changes made: Taken steps to further protect and strengthen the security of our systems
Taken steps to further enhance our security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: CA 60-day OK · 20d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Feb 19, 2021
→ Notified: Mar 11, 2021
20d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Feb 19, 2021 → Notified: Mar 11, 2021	20d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Massachusetts State AGMar 11 · first

Maine State AGMar 11 · first

Oregon State AGMar 11 · first

Indiana State AGMar 11 · first

Washington State AGMar 11 · first

California State AGMar 11 · first · this page

New Hampshire State AG+4d

South Carolina State AG+5d

Maine State AG+27d

Maine State AG+50d

New Hampshire State AG+61d

Pattern: first filing Mar 11 (MA), last May 11 (NH) — a 61-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539040
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2021
Raw hash: a5833e5ca000c4361a73d22fcea192d041b1c385f320024bcbcfdb2f34c2cff4

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPAN-AMERICAN LIFE INSURANCE GROUP, INC.

Victim entityPAN-AMERICAN LIFE INSURANCE GROUP, INC.

Incidentdiscovered Feb 19, 2021

Stated responseTook computer network offline

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov