MalwareFinancial ServicesTechnologyFinanceRansomwareData EncryptedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

The Northwestern Mutual Life Insurance Company

bd_5342023cec335745 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 2, 2023

Filed

Feb 23, 2024

To disclose

16 weeks

Affected

100state residents only

Linked

28 filings

Confidence

66%

Northwestern Mutual notified NH AG of a ransomware incident at third-party vendor Infosys McCamish Systems (IMS). IMS was informed on Nov 2, 2023. 100 NH residents' PII (name, address, DOB, SSN) potentially impacted. Newport Group administers plans for NM and provided data to IMS. Investigation ongoing; no evidence of data impact confirmed yet. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 weeks / 113 days

Nov 2, 2023

Begins

Nov 2, 2023

Discovered

Feb 23, 2024

Filed

vs. sector median

+8 wks slower

This filing is one of 28 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_2c639b79e47974562024-09-09 · +199dVerified
New Hampshire State AGbd_da623b6c9a5b4c602024-09-09 · +199dVerified by operator
Maine State AGbd_e4f30fd83097d2ea2024-09-09 · +199dVerified
New Hampshire State AGbd_76fe70ad7d12b3222024-10-17 · +237dVerified by operator

Show 6 more filings ↓up to 392d gap

California State AGbd_09e9ee0e8ae4cab22024-10-21 · +241dVerified by operator
Maine State AGbd_e146df2080ac907d2024-10-21 · +241dVerified by operator
Montana State AGbd_0c4cfe30b6b9a1792024-11-15 · +266dVerified by operator
California State AGbd_2602582028ab1a682024-12-10 · +291dVerified by operator
Maine State AGbd_0b9b35d5b78a3c9c2025-03-21 · +392dVerified by operator
California State AGbd_d5e10ce4b017519f2025-03-21 · +392dVerified by operator

Showing first 10 of 27 linked disclosures.

Name: The Northwestern Mutual Life Insurance Company
norm: the northwestern mutual life insurance
Domain: northwesternmutual.com

Name: The Northwestern Mutual Life Insurance Company
norm: infosys mccamish systems
Industry: Financial ServicesllmTechnologyllm

Discovered: Nov 2, 2023
Breach occurred: Nov 2, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 16, 2024
Affected individuals: 100state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General Consumer Protection Bureau

During the incident: IMS promptly retained a third-party forensic firm, to investigate and assist with IMS’s recovery plan
IMS engaged a leading third-party security expert, Unit 42, part of Palo Alto Networks, to validate the scope of the incident and handle remediation
IMS engaged a leading e-discovery firm, EY, to determine whether data of any of the plans or participants that we service was impacted
Newport is offering to provide individuals of free identity theft and credit monitoring services through Experian
Changes made: IMS subsequently successfully restored and rebuilt its environment
Unit 42 validated that the IMS environment has been hardened
IMS disconnected and isolated the impacted systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(113 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 4 states

View merged incident ↗

New Hampshire State AGFeb 23 · first · this page

California State AG+199d

New Hampshire State AG+199d

Maine State AG+199d

New Hampshire State AG+237d

California State AG+241d

Maine State AG+241d

Montana State AG+266d

California State AG+291d

Maine State AG+392d

California State AG+392d

Pattern: first filing Feb 23 (NH), last Mar 21 (CA) — a 392-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 27 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/northwestern-mutual-life-ins-infosys-newport-group-20240223.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 23, 2024
Raw hash: 47c225bf8fd1d74e3ee4d73718a2a25b1c7b110c0290bb45e4b8b89aedfa5c16

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Northwestern Mutual Life Insurance Company

Victim entityThe Northwestern Mutual Life Insurance Company

Incidentdiscovered Nov 2, 2023

Stated responseIMS promptly retained a third-party forensic firm, to investigate and assist with IMS’s recovery plan

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov