AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumResolved

Mutual of America Life Insurance Co.

bd_6a8f48a31fe86457 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 22, 2025

Filed

Aug 21, 2025

To disclose

4 weeks

Affected

Not disclosed

Confidence

64%

Full breach record for Mutual of America Life Insurance Co. →4 incidents on file

Mutual of America Life Insurance Company disclosed that on July 22, 2025, it unintentionally sent a secure email containing personal account information (name, SSN, plan ID, account balance) to an incorrect plan sponsor. The recipient confirmed deletion of the data. The company is offering 12 months of identity monitoring and retraining staff.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 22, 2025 → Notified Aug 20, 202529d ✓ CA 60-day OK4 weeks discovery → filing

Incident timeline

discovery → filing · 4 weeks / 30 days

Jul 22, 2025

Begins

Jul 22, 2025

Discovered

Aug 21, 2025

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Mutual of America Life Insurance Company
norm: mutual of america life insurance
Domain: mutualofomaha.com

Name: Mutual of America Life Insurance Co.
norm: mutual of america life insurance
Domain: mutualofamerica.com
Industry: Financial Servicesllm

Discovered: Jul 22, 2025
Breach occurred: Jul 22, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 20, 2025
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unknown

During the incident: Began investigating the incident as soon as we learned about it
Offering complimentary access to Experian IdentityWorks for 12 months
Re-educating all applicable staff members regarding breach prevention protocols
Implementing new procedures to prevent future recurrence
Changes made: Re-educating all applicable staff members regarding breach prevention protocols
Implementing new procedures to prevent future recurrence
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: CA 60-day OK · 29d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 22, 2025
→ Notified: Aug 20, 2025
29d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 22, 2025 → Notified: Aug 20, 2025	29d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-607490
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2025
Raw hash: 96cb80dba23ebcb5e556f84c9de426a382e0997fc999a40331db2f3ceba0eb45

Reporting entityMutual of America Life Insurance Company

Victim entityMutual of America Life Insurance Co.

Incidentdiscovered Jul 22, 2025

Stated responseBegan investigating the incident as soon as we learned about it

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov