AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedGovernment IDIdentity (basic)MediumResolved

MetLife

bd_6ddaf2d994c81869 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 10, 2018

Filed

Dec 19, 2018

To disclose

14 weeks

Affected

1state residents only

Confidence

66%

Full breach record for MetLife →22 incidents on file

MetLife mistakenly sent an email containing Social Security Numbers, names, and policy numbers to a customer who should not have received the information on September 10, 2018. One New Hampshire resident was affected. The recipient notified MetLife and deleted the report. MetLife offered one year of credit monitoring to the affected individual.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 14 weeks / 100 days

Sep 10, 2018

Begins

Sep 10, 2018

Discovered

Dec 19, 2018

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: MetLife
norm: metlife
Domain: metlife.com

Name: MetLife
norm: metlife
Domain: metlife.com
Industry: Financial Servicesllm

Discovered: Sep 10, 2018
Breach occurred: Sep 10, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 18, 2018
Affected individuals: 1state-resident count only
Data types: Government IDIdentity (basic)
Data elements: Social Security number
Attack vector: Unknown
Regulator citations: Filed Security Breach Report with New Hampshire Consumer Protection Bureau

During the incident: Offered credit protection services to the affected individual
Sent notification letter to the affected individual
Changes made: Taking steps to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/metlife-20181219.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 19, 2018
Raw hash: ae3a39834a5744f539e7f376be9d010e2db1fc03b49ce39a4735bbd985e8a74b

Reporting entityMetLife

Victim entityMetLife

Incidentdiscovered Sep 10, 2018

Stated responseOffered credit protection services to the affected individual

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov