DisclosureLens
MalwareFinancial ServicesFinanceRansomwareData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Delaware Life

bd_732e01ca4d2b557b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 9, 2023

Filed

Nov 21, 2023

To disclose

41 weeks

Affected

Not disclosed

Linked

7 records

Confidence

64%
Full breach record for Delaware Life →5 incidents on file

Delaware Life Insurance Company experienced a ransomware attack on its IT infrastructure. The company detected the malware on February 9, 2023, though the breach date listed in the state filing is November 30, 2022. An unauthorized actor accessed and acquired files containing personal information, including names, addresses, dates of birth, and Social Security numbers of agents and policyholders. The company engaged forensic experts, notified the FBI and regulators, and is offering 24 months of identity theft protection services to affected individuals.

California clockDiscovered Feb 9, 2023 → Notified Nov 21, 2023285d ✗ CA 60-day late41 weeks discovery → filing

Incident timeline

undetected · 71 days
discovery → filing · 41 weeks / 285 days

Nov 30, 2022

Begins

Feb 9, 2023

Discovered

Nov 21, 2023

Filed

vs. sector median

+32 wks slower

This filing is one of 7 records about the same incident.View merged incident
A leak claim by lockbit_3 about this victim was first seen 270 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (5) · sorted by filing gap

Show 1 more filing ↓up to 116d gap

Filing propagation · 6 filings · 5 states

View merged incident ↗
California State AGJul 28 · first
Delaware State AGJul 28 · first
California State AG+116d · this page

Pattern: first filing Jul 28 (CA), last Nov 21 (CA) — a 116-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.