HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedCustomer Data InvolvedIdentity (basic)MediumResolved

Athene Annuity and Life Company and its affiliates

bd_9def23da88b251ff · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 20, 2023

Filed

Jul 20, 2023

To disclose

4 weeks

Affected

3,814state residents only

Linked

7 filings

Confidence

69%

Full breach record for Athene Annuity and Life Company and its affiliates →

Athene Annuity and Life Company and its affiliates filed a supplemental notice with the Washington Attorney General regarding a security incident involving third-party administrator Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer software was exploited between May 29-30, 2023, allowing unauthorized access and data download. The incident affected 3,814 Washington residents. PBI patched servers, conducted manual reviews, and offered 12 months of complimentary identity monitoring via Kroll. The investigation is closed.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d4 weeks discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 4 weeks / 30 days

May 29, 2023

Begins

Jun 20, 2023

Discovered

Jul 20, 2023

Filed

vs. sector median

5 wks faster

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Maine State AGbd_0b2433a9bf13981d2023-07-20Verified
California State AGbd_2122d1ad58be678c2023-07-20Candidate
Oregon State AGbd_4774c894ba19f11e2023-07-20Verified
Massachusetts State AGbd_f3b455d733dfc9832023-07-20Verified

Show 2 more filings ↓up to 60d gap

Indiana State AGbd_7d325a3c7384fda72023-07-14 · +6dVerified
Oregon State AGbd_a61e1b257e7714442023-09-18 · +60dVerified

Name: Athene Annuity and Life Company and its affiliates
norm: athene annuity and life company and its affiliates

Name: Athene Annuity and Life Company and its affiliates
norm: athene annuity and life company and its affiliates
Industry: Financial Servicesllm

Discovered: Jun 20, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2023
Affected individuals: 3,814state-resident count only
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
Conducted a manual review of our records to confirm the identities of individuals potentially affected by this event
Patched servers
Notify potentially affected customers and individuals associated with those customers
Reviewing and enhancing our information security policies and procedures
Offering you access to 12 months of complimentary identity monitoring services through Kroll
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Indiana State AGJul 14 · first

Maine State AG+6d

California State AG+6d

Oregon State AG+6d

Massachusetts State AG+6d

Washington State AG+6d · this page

Oregon State AG+66d

Pattern: first filing Jul 14 (IN), last Sep 18 (OR) — a 66-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA25920.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 20, 2023
Raw hash: 067e5f3756e15e7a28f012af359b17bc52023a929bfa6074e2b095a901482423

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityAthene Annuity and Life Company and its affiliates

Victim entityAthene Annuity and Life Company and its affiliates

Incidentdiscovered Jun 20, 2023

Stated responsePromptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com