HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
Fidelity Life Association
bd_82f96c9578d3827e · schema v1 · pii pii-v1
Full breach record for Fidelity Life Association →Fidelity Life Association notified the California AG of a data breach affecting its customers. The incident resulted from a vulnerability in Progress Software's MOVEit Transfer product, exploited by an unauthorized third party on May 29-30, 2023. Data was downloaded from the server. Affected data includes names and other data elements. The organization patched servers, investigated the scope, and offered identity monitoring services through Kroll.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_f933ba9a65c7ad54Oregon State AGfiled 2023-07-25Verified
- bd_432abee4b3c12739Montana State AGfiled 2023-08-14(20d gap)Verified
- bd_8c3c5b0459c1e381Washington State AGfiled 2023-08-14(20d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-570809
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 25, 2023
- Raw hash
- a2b6e43082999a3f1931fb8d357d45d6dbebcfb4eacd1bd8968ecc00474cbf74
Reporting entity
- Name
- Fidelity Life Associationnorm: fidelity life
Victim entity
- Name
- Fidelity Life Associationnorm: fidelity life
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 8 weeks(55 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.