AccidentalFinancial ServicesHealthcareFinanceMisconfigurationCustomer Data InvolvedPIIPHIFinancial accountIdentity (basic)Health (basic)LowContained

PACIFIC LIFE INSURANCE COMPANY

bd_5ac90219b475e86b · schema v1 · pii pii-v1

Severity

Low

Discovered

May 8, 2020

Filed

May 29, 2020

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

65%

Full breach record for PACIFIC LIFE INSURANCE COMPANY →10 incidents on file

Pacific Life Insurance Company experienced a data privacy incident where a firewall update introduced a caching feature that exposed policyowners' documents to other users for up to five minutes. The incident involved PII, PHI, and financial data. Pacific Life shut down the portal, disabled the feature, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

May 7, 2020

Begins

May 8, 2020

Discovered

May 29, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_9a8bfc6a77d9d0712020-05-29Verified

Name: PACIFIC LIFE INSURANCE COMPANY
norm: pacific life insurance

Name: PACIFIC LIFE INSURANCE COMPANY
norm: pacific life insurance
Industry: Financial ServicesllmHealthcarellm

Discovered: May 8, 2020
Breach occurred: May 7, 2020 – May 12, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 8, 2020
Affected individuals: 1state-resident count only
Data types: PIIPHIFinancial accountIdentity (basic)Health (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application

During the incident: Shut down the portal
Permanently disabled the caching feature
Added additional controls to the underlying service
Offered complimentary membership to Experian’s IdentityWorks for 24 months
Changes made: Added additional controls to the underlying service as a second line of defense
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 29 · first

Montana State AGMay 29 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/General-Notice-87.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 29, 2020
Raw hash: dd148672954d560e92d5b97b851a74d231e1f6d18c7c9a661de1eb987c151f1c

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPACIFIC LIFE INSURANCE COMPANY

Victim entityPACIFIC LIFE INSURANCE COMPANY

Incidentdiscovered May 8, 2020

Stated responseShut down the portal

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov