HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Pension Benefit Information, LLC
bd_8a9b6ba4c65dda36 · schema v1 · pii pii-v1
Full breach record for Pension Benefit Information, LLC →Global Atlantic Financial Group LLC notified policyholders that third-party vendor Pension Benefits Information LLC (PBI) experienced a MOVEit file transfer vulnerability exploitation. Cyber criminals accessed PBI's server on May 29-30, 2023, and exfiltrated policyholder data including names and government identifiers. Global Atlantic learned of the incident on June 7, 2023, and issued notifications on July 28, 2023, offering two years of Experian IdentityWorks. Global Atlantic's own environment was not compromised.
This filing is one of 9 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (8) · sorted by filing gap
- bd_eb47f1a922c8d8ddDelaware State AGfiled 2023-07-17(11d gap)Candidate
- bd_729ad9694adf695eNew Hampshire State AGfiled 2023-07-14(14d gap)Verified
- bd_bc42d7fee9bd036cMaine State AGfiled 2023-08-16(19d gap)Candidate
- bd_5a81a9b3803e493cDelaware State AGfiled 2023-08-23(26d gap)Verified
Show 4 more filings ↓Show fewer ↑up to 28d gap
- bd_31eb3a86b455ca2aCalifornia State AGfiled 2023-08-24(27d gap)Verified
- bd_88a232a96ae8d0e9New Hampshire State AGfiled 2023-08-24(27d gap)Verified
- bd_f52c76855c9e670bNew Hampshire State AGfiled 2023-08-24(27d gap)Verified
- bd_ed5751101a0d93eeVermont State AGfiled 2023-08-25(28d gap)Verified
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/08/Sample-GAFG-Policyholder-Notification-Template-Letter.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 28, 2023
- Raw hash
- 96033614a3f0f49b7cf4e87d5bd7f9a7df6064a4eca3a330986fa2f70ddbb797
Reporting entity
- Name
- Global Atlanticnorm: global atlantic
- Domain
- globalatlantic.com
Victim entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Incident
- Discovered
- Jun 7, 2023
- Materiality determined
- —
- Notification sent
- Jul 28, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- reported the incident to the appropriate authorities
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(51 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.