MalwarePIIIdentity (basic)MediumContained

First Security Benefit Life Insurance and Annuity Company of New York

bd_7d4765ddfba5191a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 9, 2023

Filed

Dec 26, 2023

To disclose

46 weeks

Affected · nationwide

4,3934 in this filing

Linked

2 filings

Confidence

67%

Full breach record for First Security Benefit Life Insurance and Annuity Company of New York →

Supplemental state-AG notice (NH, Dec 26, 2023) regarding a ransomware incident affecting Clear Spring Life and Annuity Company (CSLAC), which administers policies for First Security Benefit Life Insurance (FSBL). Discovered Feb 9, 2023, the breach impacted 4,393 individuals total, including 4 New Hampshire residents. CSLAC notified the FBI, did not pay ransom, and provided 2 years of free credit monitoring/identity protection via IDX. Initial notice was July 27, 2023; supplemental notice covers 3 additional NH residents notified Nov 21, 2023.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 46 weeks / 320 days

Feb 9, 2023

Discovered

Dec 26, 2023

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_8193c6a86f1692c72023-07-28 · +151dCandidate

Name: CLEAR SPRING LIFE AND ANNUITY COMPANY
norm: clear spring life and annuity

Name: First Security Benefit Life Insurance and Annuity Company of New York
norm: first security benefit life insurance and annuity company of new york
Domain: fsbl.com

Discovered: Feb 9, 2023
Materiality determined: —
Notification sent: Jul 28, 2023
Affected individuals: 4,393state + nationwide
Data types: PIIIdentity (basic)
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Reported to New Hampshire Attorney General Consumer Protection Bureau

During the incident: Retained a leading third-party forensics firm to conduct a thorough investigation
Alerted the Federal Bureau of Investigation
Sent notice to affected New Hampshire residents via first class mail on July 28, 2023
Arranged to make credit monitoring and identity protection services by IDX available to the individual at no cost for two (2) years
Changes made: Scanned systems for, and remediated, any identified indicators of compromise
Rebuilt systems prior to bringing them back online
Deployed additional advanced endpoint detection and monitoring tools on the newly restored systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 46 weeks(320 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGJul 28 · first

New Hampshire State AG+151d · this page

Pattern: first filing Jul 28 (IN), last Dec 26 (NH) — a 151-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/first-security-benefit-life-insurance-company-new-york-clear-spring-life-annuity-company-20231226.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 26, 2023
Raw hash: 8728848667fe44f63b039f7cdb0249ea5e2817eee95b295b543929773e3492b0

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCLEAR SPRING LIFE AND ANNUITY COMPANY

Victim entityFirst Security Benefit Life Insurance and Annuity Company of New York

Incidentdiscovered Feb 9, 2023

Stated responseRetained a leading third-party forensics firm to conduct a thorough investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov