DisclosureLens
HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)PIIMediumContained

The Global Atlantic Financial Group LLC

bd_996dba95423b3558 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Jul 28, 2023

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%
Full breach record for The Global Atlantic Financial Group LLC7 incidents on file

The Global Atlantic Financial Group LLC (GAFG) disclosed a cybersecurity incident involving its third-party vendor, Pension Benefits Information LLC (PBI). PBI's MOVEit file transfer application was exploited via an unpatched vulnerability (zero-day at the time) between May 29-30, 2023. Cybercriminals exfiltrated policyholder data, including names and government identifiers (SSNs, DOBs). GAFG notified affected individuals in July 2023, offering two years of credit monitoring. GAFG stated its own environment was not directly compromised.

Incident timeline

undetected · 2 days
discovery → filing · 8 weeks / 58 days

May 29, 2023

Begins

May 31, 2023

Discovered

Jul 28, 2023

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident
Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Filing propagation · 2 filings · 2 states

View merged incident ↗
Delaware State AGJul 28 · first · this page

Pattern: first filing Jul 28 (DE), last Aug 14 (CA) — a 17-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.