HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
LUMICO LIFE INSURANCE COMPANY
bd_60ed3513a32e4a46 · schema v1 · pii pii-v1
Full breach record for LUMICO LIFE INSURANCE COMPANY →Lumico Life Insurance Company disclosed that a third-party service provider (NTT Data Services) and its sub-vendor (Pension Benefits Information, LLC) were compromised via an exploit of the MOVEit Transfer application vulnerability. The incident occurred between May 29-30, 2023, and was discovered on June 19, 2023. Policyholder data including names, SSNs, DOBs, and addresses was exfiltrated. Lumico engaged Kroll for identity monitoring and notified regulators.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_edf05202d5329622Washington State AGfiled 2023-07-27(5d gap)Verified
- bd_d6bf8fde23a83ea1Delaware State AGfiled 2023-07-26(6d gap)Verified
- bd_a4bb1ffa233d029eOregon State AGfiled 2023-08-14(13d gap)Verified
- bd_f409b232fcffae5cDelaware State AGfiled 2023-07-16(16d gap)Candidate
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-571134
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 1, 2023
- Raw hash
- 082fa7d40e3f1a59b157ca7c1cf5ef7a1194c7a2f0e5882e9522ebb20e77bac1
Reporting entity
- Name
- LUMICO LIFE INSURANCE COMPANYnorm: lumico life insurance
- Domain
- lumico.com
Victim entity
- Name
- LUMICO LIFE INSURANCE COMPANYnorm: lumico life insurance
- Domain
- lumico.com
Incident
- Discovered
- Jun 19, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified relevant state regulators and federal law enforcement authorities
- Third party
- via NTT Data Services
- Initial access
- supply_chain
Compliance
- Time to disclose
- 6 weeks(43 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.