HackingVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHighContained
Sun Life Assurance Company of Canada
bd_9fd1580b816758ab · schema v1 · pii pii-v1
Full breach record for Sun Life Assurance Company of Canada →Sun Life Assurance Company of Canada reported a data breach affecting 3,282 Hawaii residents. A third-party vendor, Pension Benefit Information, LLC (PBI), was compromised via a zero-day vulnerability in Progress Software's MOVEit Transfer software. The incident involved unauthorized access to files containing names, Social Security Numbers, and dates of birth. Sun Life engaged legal counsel, blocked access to PBI, and provided 24 months of credit monitoring to affected individuals. Notifications were sent starting August 21, 2023.
This filing is one of 4 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (3) · sorted by filing gap
- bd_500b8c615d2fdb8fWashington State AGfiled 2023-08-23(1d gap)Verified
- bd_9f15b58e2b3344f6Oregon State AGfiled 2023-08-23(1d gap)Verified
- bd_69b02d7eb4f6f783California State AGfiled 2023-08-21(1d gap)Verified
Source provenance
- Source URL
- https://cca.hawaii.gov/wp-content/uploads/2026/05/2023-0867.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 22, 2023
- Raw hash
- a2a33e7c0e7cad95e63fb29fb321d1c7431558c9dee09dde5c7ae470e038209b
Reporting entity
- Name
- Sun Life Assurance Company of Canadanorm: sun life assurance company of canada
Victim entity
- Name
- Sun Life Assurance Company of Canadanorm: sun life assurance company of canada
Incident
- Discovered
- Jun 22, 2023
- Materiality determined
- —
- Notification sent
- Aug 21, 2023
- Affected individuals
- 3,282
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- Provided notice to the Office of Consumer Protection, Hawaii
- Third party
- via Pension Benefit Information, LLC
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(61 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.