HackingFinancial ServicesHealthcareFinanceVulnerability ExploitCapture Stored DataSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedMulti-Stage ChainPIIIdentity (basic)Government IDFinancial accountHealth (basic)MediumActive

Delaware Life of New York and Nassau Life Insurance Company

bd_9cb1d0e65f7248f1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 7, 2023

Filed

Aug 23, 2023

To disclose

7 weeks

Affected

2state residents only

Confidence

66%

Full breach record for Delaware Life of New York and Nassau Life Insurance Company →

Nassau Life Insurance Company reported a cybersecurity incident impacting Delaware Life of New York (DLNY) customers. A threat actor exploited a vulnerability in MOVEit Transfer software via third-party vendor Pension Benefit, LLC, on May 29-30, 2023. Nassau discovered the incident on July 7, 2023, upon notice from Sun Life. Two New Hampshire residents' data was compromised. Nassau is investigating and notifying affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 39 days

discovery → filing · 7 weeks / 47 days

May 29, 2023

Begins

Jul 7, 2023

Discovered

Aug 23, 2023

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2 affectedView incident

Name: NASSAU LIFE INSURANCE COMPANY
norm: nassau life insurance

Name: Delaware Life of New York and Nassau Life Insurance Company
norm: delaware life of new york and nassau life insurance
Industry: Financial ServicesllmHealthcarellm

Discovered: Jul 7, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 39 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2state-resident count only
Data types: PIIIdentity (basic)Government IDFinancial accountHealth (basic)
Data elements: Date of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney GeneralSun Life notified federal law enforcement officials
Initial access: exploit_public_facing

During the incident: Began an investigation in July 2023
Made an initial assessment to notify governmental bodies
Received formal written notice from Sun Life
Shared files with Nassau to investigate provenance
Confirmed data relates to DLNY customers
Proactively reached out to top-tier vendors to confirm impact
Analyzing cybersecurity and data security practices
Working with risk management providers to identify, quantify, and mitigate risk
Committed to sending written notice to each affected individual
Changes made: Analyzing own cybersecurity and data security practices
Working with risk management providers to identify, quantify, and mitigate inherent risk in sharing sensitive data with vendors
Analyzing, rating, and monitoring security performance of third parties in vendor portfolio
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(47 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delaware-life-new-york-nassau-life-insurance-company-20230823.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 23, 2023
Raw hash: efda8216c839d178203d8e627ad73fa2ab026de744a3fff02391bd9aafeac9a5

Reporting entityNASSAU LIFE INSURANCE COMPANY

Victim entityDelaware Life of New York and Nassau Life Insurance Company

Incidentdiscovered Jul 7, 2023

Stated responseBegan an investigation in July 2023

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov