MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Ransom DemandedData EncryptedCustomer Data InvolvedPIIIdentity (basic)Government IDHighResolved

HERITAGE LIFE INSURANCE COMPANY

bd_7bf68d72b35a2952 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 12, 2022

Filed

Jul 7, 2022

To disclose

17 weeks

Affected · nationwide

58,144315 in this filing

Linked

8 filings

Confidence

65%

Full breach record for HERITAGE LIFE INSURANCE COMPANY →3 incidents on file

Heritage Life Insurance Company reported a data breach affecting 58,144 individuals. The incident was a ransomware attack at a third-party IT services vendor. The breach occurred and was discovered on March 12, 2022. Exposed information includes names and Social Security numbers. The company began notifying affected individuals on July 13, 2022, and offered 12 months of identity theft and credit monitoring services.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Mar 12, 2022 → Filed with AG Jul 7, 2022117d ✗ ME AG >90d17 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 17 weeks / 117 days

Mar 12, 2022

Begins

Mar 12, 2022

Discovered

Jul 7, 2022

Filed

vs. sector median

+8 wks slower

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Washington State AGbd_32fe7e85d055dc7c2022-07-08 · +1dVerified
Maine State AGbd_7cced443f4d63d322022-07-08 · +1dCandidate
Massachusetts State AGbd_10a2163a454958b52022-07-14 · +7dVerified
California State AGbd_4b9699f3bfd93e352022-07-14 · +7dVerified

Show 3 more filings ↓up to 7d gap

Indiana State AGbd_8be92c67804847282022-07-14 · +7dVerified
Montana State AGbd_de282c076ab825242022-07-14 · +7dVerified
Oregon State AGbd_ed52f06bbb2c84e12022-07-14 · +7dVerified

Name: HERITAGE LIFE INSURANCE COMPANY
norm: heritage life insurance

Name: HERITAGE LIFE INSURANCE COMPANY
norm: heritage life insurance
Industry: Financial Servicesllm

Discovered: Mar 12, 2022
Breach occurred: Mar 12, 2022
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 13, 2022
Affected individuals: 58,144state + nationwide
Data types: PIIIdentity (basic)Government ID
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1195 Supply Chain Compromise
Threat actor: ExternalFinancial

During the incident: Offered 12 months of identity theft and credit monitoring by Epiq
Sent written notification to affected individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(117 days from discovery to filing)
Compliance flags: ME AG >90d · 117dME resident >60d · 123d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Mar 12, 2022
→ Filed with AG: Jul 7, 2022
117d 90 days ME AG >90d
Maine
Discovered: Mar 12, 2022
→ Notified: Jul 13, 2022
123d 60 days (analyst band; statutory cap is 30 days) ME resident >60d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Mar 12, 2022 → Filed with AG: Jul 7, 2022	117d	90 days	ME AG >90d
Maine	Discovered: Mar 12, 2022 → Notified: Jul 13, 2022	123d	60 days (analyst band; statutory cap is 30 days)	ME resident >60d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Maine State AGJul 7 · first · this page

Washington State AG+1d

Maine State AG+1d

Massachusetts State AG+7d

California State AG+7d

Indiana State AG+7d

Montana State AG+7d

Oregon State AG+7d

Pattern: first filing Jul 7 (ME), last Jul 14 (OR) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f5517460-35e8-451e-aa8e-a85b6b0abea2.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 7, 2022
Raw hash: a8dc71b8d844d4f433f3e98db98167d16d46b855fe5d75d413db6dd6c573cd66

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityHERITAGE LIFE INSURANCE COMPANY

Victim entityHERITAGE LIFE INSURANCE COMPANY

Incidentdiscovered Mar 12, 2022

Stated responseOffered 12 months of identity theft and credit monitoring by Epiq

ComplianceME AG >90d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov