Milliman Solutions LLC
bd_8674a4bac38b2e61 · schema v1 · pii pii-v1
Full breach record for Milliman Solutions LLC →Milliman Solutions LLC reported a data breach involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI utilized Progress Software's MOVEit Transfer software, which contained a zero-day vulnerability (CVE-2023-34362). An unauthorized actor accessed PBI's servers on May 29-30, 2023, and exfiltrated data. The breach affected approximately 1,280,823 individuals nationwide, including 4,206 Maine residents. Affected data included names and Social Security Numbers. Notification to consumers began on July 17, 2023, offering 12 months of credit monitoring and identity theft restoration services.
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_24ccb026f721af63Oregon State AGfiled 2023-07-17Candidate
- bd_a000c0cf3a8e0660California State AGfiled 2023-07-17Verified
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a98d9ae9-b898-4aaa-8dde-de04551aaedb.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 17, 2023
- Raw hash
- a1172aeb44ea566559697ac78e2dbdde3f798c184f48af7b6ce56cb85b323cbf
Reporting entity
- Name
- Milliman Solutions LLCnorm: milliman solutions
- Domain
- milliman.com
Victim entity
- Name
- Milliman Solutions LLCnorm: milliman solutions
- Domain
- milliman.com
Incident
- Discovered
- Jun 16, 2023
- Materiality determined
- —
- Notification sent
- Jul 17, 2023
- Affected individuals
- 1,280,823
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed data breach notice with Maine Attorney General
- Initial access
- exploit_public_facing
- CVE references
Compliance
- Time to disclose
- 4 weeks(31 days from discovery to filing)
- Compliance flags
- ME AG >30d · 31d
- Discovery-date grounding
- AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jun 16, 2023→ Filed with AG: Jul 17, 202331d 30 days (soft) ME AG >30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.