HackingFinancial ServicesHealthcareFinanceVulnerability ExploitData ExfiltratedSupply Chain (3P Vendor)TargetedIdentity (basic)Government IDHealth (basic)Financial accountHighContained

UNUM GROUP

bd_5fd3c14b044d2a09 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 1, 2023

Filed

Sep 19, 2023

To disclose

16 weeks

Affected

10,527state residents only

Linked

7 filings

Confidence

64%

Full breach record for UNUM GROUP →12 incidents on file

Unum Group notified South Carolina residents of a cybersecurity incident involving its MOVEit Transfer application (Progress Software). Unauthorized access occurred May 31-June 1, 2023, exploiting a vulnerability to exfiltrate data including names, SSNs, medical info, and financial data. Unum detected suspicious activity on June 1, 2023, and began notifying individuals on August 3, 2023. Response included taking the system offline, patching, and offering 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 16 weeks / 110 days

May 31, 2023

Begins

Jun 1, 2023

Discovered

Sep 19, 2023

Filed

vs. sector median

+7 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

A leak claim by lockbit2 about this victim predates this filing by 577 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_60e06d7b099885312023-09-19Verified
Massachusetts State AGbd_d63872c90f649d742023-09-19Verified
Oregon State AGbd_be1b59e27105faaa2023-09-05 · +14dVerified
Washington State AGCL0Pbd_e9863c8671e00ee82023-08-21 · +29dVerified

Show 2 more filings ↓up to 47d gap

Indiana State AGbd_7e4b64e3b2796a5e2023-08-03 · +47dCandidate
HHS OCRbd_daff25a5bf2dc4eb2023-08-03 · +47dCandidate

Name: UNUM GROUP
norm: unum group
Domain: plane.biz

Name: UNUM GROUP
norm: unum group
Domain: plane.biz
Industry: Financial ServicesllmHealthcarellm

Discovered: Jun 1, 2023
Breach occurred: May 31, 2023 – Jun 1, 2023
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2023
Affected individuals: 10,527state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: notifying law enforcement
Initial access: exploit_public_facing

During the incident: Taking MOVEit Transfer offline
Implementing vendor-recommended actions including application of patches as Progress made them available
Notifying law enforcement
Monitoring publicly available information regarding this vulnerability
Changes made: Continues to further enhance its security controls to protect from cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: Leak >180dSC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGAug 3 · first

HHS OCRAug 3 · first

Washington State AG+18d

Oregon State AG+33d

California State AG+47d

Massachusetts State AG+47d

South Carolina State AG+47d · this page

Pattern: first filing Aug 3 (IN), last Sep 19 (SC) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/UnumGroup.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 19, 2023
Raw hash: c92f914ef216afe714ce0d87979340d04ecdc9d360c3eaf3b845dbcd1163b8d9

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityUNUM GROUP

Victim entityUNUM GROUP

Incidentdiscovered Jun 1, 2023

Stated responseTaking MOVEit Transfer offline

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov