DisclosureLens
HackingFinancial ServicesTechnologyFinanceVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)CVE-2023-34362CriticalContained

Milliman Solutions LLC

bd_8674a4bac38b2e61 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jun 16, 2023

Filed

Jul 17, 2023

To disclose

4 weeks

Affected · nationwide

1,280,8234,206 in this filing

Linked

9 filings

Confidence

66%
Full breach record for Milliman Solutions LLC →2 incidents on file

Milliman Solutions LLC reported a data breach involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI utilized Progress Software's MOVEit Transfer software, which contained a zero-day vulnerability (CVE-2023-34362). An unauthorized actor accessed PBI's servers on May 29-30, 2023, and exfiltrated data. The breach affected approximately 1,280,823 individuals nationwide, including 4,206 Maine residents. Affected data included names and Social Security Numbers. Notification to consumers began on July 17, 2023, offering 12 months of credit monitoring and identity theft restoration services.

Maine clockDiscovered Jun 16, 2023 → Filed with AG Jul 17, 202331d ⏱ ME AG >30d4 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 18 days
discovery → filing · 4 weeks / 31 days

May 29, 2023

Begins

Jun 16, 2023

Discovered

Jul 17, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 9 filings about the same incident.View merged incident
Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Show 4 more filings ↓up to 5d gap

Filing propagation · 9 filings · 9 states

View merged incident ↗
Oregon State AGJul 17 · first
Indiana State AGJul 17 · first
Montana State AGJul 17 · first
Massachusetts State AGJul 17 · first
Washington State AGJul 17 · first
California State AGJul 17 · first
Delaware State AGJul 17 · first
Maine State AGJul 17 · first · this page
South Carolina State AG+5d

Pattern: first filing Jul 17 (OR), last Jul 22 (SC) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.