HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDMediumContained

United Association National Pension Fund

bd_75b893cc3d8162c4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 12, 2023

Filed

Sep 18, 2023

To disclose

10 weeks

Affected

30state residents only

Linked

5 filings

Confidence

66%

Full breach record for United Association National Pension Fund →

United Association National Pension Fund notified NH AG of a third-party data breach involving vendor Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer software was exploited via a zero-day vulnerability. Unauthorized access occurred May 29-30, 2023. Fund discovered incident July 12, 2023. 30 NH residents affected; data included names and government IDs. Notifications sent Sept 6, 2023, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 44 days

discovery → filing · 10 weeks / 68 days

May 29, 2023

Begins

Jul 12, 2023

Discovered

Sep 18, 2023

Filed

vs. sector median

on median

This filing is one of 5 filings about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Massachusetts State AGbd_6dfc70f3aa9bb2a42023-09-15 · +3dVerified
Maine State AGbd_a15ffe4add5704ea2023-09-15 · +3dCandidate
Montana State AGbd_ec3d3ca6811052692023-09-15 · +3dVerified
Indiana State AGbd_aa6a672f7ebfa3d22023-09-06 · +12dVerified

Name: United Association National Pension Fund
norm: united association national pension

Name: United Association National Pension Fund
norm: united association national pension
Industry: Financial Servicesllm

Discovered: Jul 12, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 44 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 6, 2023
Affected individuals: 30state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of Attorney General
Initial access: exploit_public_facing

During the incident: PBI provided the Fund with a list of potentially impacted individuals and their state of residency
PBI, on behalf of the Fund, began providing written notice of this incident to the potentially impacted New Hampshire residents
Offering complimentary credit monitoring and identity protection services
Changes made: PBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
PBI conducted a manual review of our records to confirm the identities of individuals potentially affected
PBI is reviewing and enhancing its information security policies and procedures
PBI took steps to patch servers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGSep 6 · first

Massachusetts State AG+9d

Maine State AG+9d

Montana State AG+9d

New Hampshire State AG+12d · this page

Pattern: first filing Sep 6 (IN), last Sep 18 (NH) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/united-association-national-pension-fund-20230918.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 18, 2023
Raw hash: 761171fd0129ff0b356226d2f50b7858c35c64fc83941dae800af1e17e04e17d

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityUnited Association National Pension Fund

Victim entityUnited Association National Pension Fund

Incidentdiscovered Jul 12, 2023

Stated responsePBI provided the Fund with a list of potentially impacted individuals and their state of residency

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov