HackingVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedZero-DayPIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTMediumContained
Andesa
bd_871d7add6a1eb545 · schema v1 · pii pii-v1
Full breach record for Andesa →Andesa Services disclosed that an unknown actor exploited a previously unknown vulnerability in Progress Software's MOVEit Transfer tool, accessing data between May 30-31, 2023. The incident affected 406 Rhode Island residents. Andesa applied patches, launched a third-party investigation, and offered credit monitoring.
California clockDiscovered May 31, 2023 → Notified Oct 23, 2023145d ✗ CA 60-day late21 weeks discovery → filing
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_6c4814cd840b0507Montana State AGfiled 2023-10-23Candidate
- bd_18f81f490bcf9b00Maine State AGfiled 2023-10-25(2d gap)Verified
- bd_7515e55209419011New Hampshire State AGfiled 2023-10-25(2d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-575514
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 23, 2023
- Raw hash
- 87d0b85fd7e68fbd45e667a1e2141c7f003418794c0a99a1a5b5be0946b60fd1
Reporting entity
- Name
- NEW YORK LIFE INSURANCE COMPANYnorm: new york life insurance
- Domain
- andesaservices.com
Victim entity
- Name
- Andesanorm: andesa
- Domain
- andesaservices.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Oct 23, 2023
- Affected individuals
- 406
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Third party
- via Progress Software Corp.
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 21 weeks(145 days from discovery to filing)
- Compliance flags
- CA 60-day late · 145dLeak >90d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 31, 2023→ Notified: Oct 23, 2023145d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.