Delaware Life
bd_944ef0f6ac2a4747 · schema v1 · pii pii-v1
Full breach record for Delaware Life →Delaware Life Insurance Company notified the California AG of a data breach affecting its customers. The incident resulted from an exploit of a vulnerability in Progress Software's MOVEit Transfer product, a third-party service used by Pension Benefit Information (PBI), a vendor for Delaware Life. An unauthorized third party accessed PBI's MOVEit server on May 29-30, 2023, and downloaded data containing names and other personal information. PBI discovered the vulnerability on May 31, 2023, when Progress Software disclosed it. PBI patched servers, investigated the scope, and is offering 24 months of identity monitoring to affected individuals.
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-572874
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 6, 2023
- Raw hash
- b7ce93f3cc7a43461f8825ef32eadacf7bc73ab51d233a5d2147a5f950855047
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Delaware Lifenorm: delaware life
- Domain
- delawarelife.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Sep 6, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 14 weeks(98 days from discovery to filing)
- Compliance flags
- CA 60-day late · 98dLeak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 31, 2023→ Notified: Sep 6, 202398d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.