Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)CriticalActive

The Union Labor Life Insurance Company

bd_850447a012c59956 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Aug 28, 2019

Filed

Sep 9, 2019

To disclose

12 days

Affected · nationwide

186,900615 in this filing

Confidence

68%

Full breach record for The Union Labor Life Insurance Company →14 incidents on file

The Union Labor Life Insurance Company reported a phishing incident where an employee's email account was compromised on April 1, 2019. The attacker accessed contact info and sent spam. Forensic review found PHI, SSNs, and PII in the mailbox. 186,900 individuals affected nationwide, including 615 in Washington. Notifications and credit monitoring were offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 149 days

discovery → filing · 12 days

Apr 1, 2019

Begins

Aug 28, 2019

Discovered

Sep 9, 2019

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed186,900 affectedView incident

Name: The Union Labor Life Insurance Company
norm: the union labor life insurance
Domain: ullico.com

Name: The Union Labor Life Insurance Company
norm: the union labor life insurance
Domain: ullico.com
Industry: Financial Servicesllm

Discovered: Aug 28, 2019
Breach occurred: Apr 1, 2019
Undetected for: 149 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 9, 2019
Affected individuals: 186,900state + nationwide
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General's Office
Initial access: phishing_link

During the incident: Disabled the employee's email account
Sequestered the employee's computer from the Company network
Purged all instances of the malicious email from its system
Sent a message to recipients of the malicious emails
Engaged a third party vendor to satisfy individual notification requirements
Staffed a call center for questions from affected individuals
Offered 24 months of credit monitoring and identity theft protection
Posted a press release on the Company website
Notified major media outlets
Changes made: Offered 24 months of credit monitoring and identity theft protection at the Company's sole expense
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 days(12 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10656.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 9, 2019
Raw hash: 4a18df9d3dc757a44f6e576372733b9f3daa35d8e41ab05d413f099626e64b8a

Reporting entityThe Union Labor Life Insurance Company

Victim entityThe Union Labor Life Insurance Company

Incidentdiscovered Aug 28, 2019

Stated responseDisabled the employee's email account

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com