HackingStolen CredentialsCustomer Data InvolvedPIIIDENTITY_BASICLowContained
Massachusetts Mutual Life Insurance Company
bd_61bf81906947ed94 · schema v1 · pii pii-v1
Full breach record for Massachusetts Mutual Life Insurance Company →MassMutual experienced unauthorized access to an independent agency employee's online account on February 1, 2023. The company became aware of the incident on February 2, 2023. The breach involved personal information, including names and potentially other identity data, accessed via the employee's Microsoft Outlook mailbox. MassMutual secured the account, launched an investigation, and offered 24 months of identity protection services through IdentityForce to affected individuals.
California clockDiscovered Feb 2, 2023 → Notified Apr 27, 202384d ✗ CA 60-day late12 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_ac1cfa7a115c4825Montana State AGfiled 2023-04-27Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-566036
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 27, 2023
- Raw hash
- 0212738477d529e896fb311afde0c3281b25e6f49d33b6af9de13ceab8e85d2f
Reporting entity
- Name
- Massachusetts Mutual Life Insurance Companynorm: massachusetts mutual life insurance
Victim entity
- Name
- Massachusetts Mutual Life Insurance Companynorm: massachusetts mutual life insurance
Incident
- Discovered
- Feb 2, 2023
- Materiality determined
- —
- Notification sent
- Apr 27, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1114 Email Collection
- Threat actor
- External
- Third party
- via Independent MassMutual agency employee
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 12 weeks(84 days from discovery to filing)
- Compliance flags
- CA 60-day late · 84d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Feb 2, 2023→ Notified: Apr 27, 202384d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.