HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDHighContained

Sun Life Assurance Company of Canada

bd_9fd1580b816758ab · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 22, 2023

Filed

Aug 22, 2023

To disclose

9 weeks

Affected

3,282state residents only

Linked

4 filings

Confidence

66%

Full breach record for Sun Life Assurance Company of Canada →5 incidents on file

Sun Life Assurance Company of Canada notified Hawaii regulators of a data breach involving third-party vendor Pension Benefit Information, LLC (PBI). A threat actor exploited a zero-day vulnerability in Progress Software's MOVEit Transfer software to access PBI's systems on May 29-30, 2023. The incident affected 3,282 Hawaii residents, exposing names, Social Security numbers, and/or dates of birth. Sun Life engaged legal counsel, blocked access to PBI, and offered 24 months of credit monitoring. Notifications were sent on or about August 21, 2023.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 24 days

discovery → filing · 9 weeks / 61 days

May 29, 2023

Begins

Jun 22, 2023

Discovered

Aug 22, 2023

Filed

vs. sector median

on median

This filing is one of 4 about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Washington State AGbd_500b8c615d2fdb8f2023-08-23 · +1dVerified
Oregon State AGbd_9f15b58e2b3344f62023-08-23 · +1dVerified
California State AGbd_69b02d7eb4f6f7832023-08-21 · +1dVerified

Name: Sun Life Assurance Company of Canada
norm: sun life assurance company of canada

Name: Sun Life Assurance Company of Canada
norm: sun life assurance company of canada
Industry: Financial Servicesllm

Discovered: Jun 22, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 24 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 21, 2023
Affected individuals: 3,282state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Provided notice to the Office of Consumer Protection in HawaiiProviding notice to appropriate agencies in other jurisdictions
Initial access: exploit_public_facing

During the incident: Engaged its internal Cybersecurity Incident Management process
Assigned a cross functional team to lead the internal investigation
Engaged outside legal counsel
Took immediate steps to block its link to PBI
Sent notification letters to the affected individuals
Offered credit monitoring and identity theft protection services for at least twenty four (24) months
Changes made: PBI installed the required security patches provided by Progress Software
PBI conducted its own forensics investigation
PBI engaged an independent forensics firm
PBI enhanced its safeguards for data, including setting new rules for deletion of data from its instance of the software
Reviewing and enhancing its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

California State AGAug 21 · first

Hawaii State AG+1d · this page

Washington State AG+2d

Oregon State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/2023-0867.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 22, 2023
Raw hash: fae76a4cd2369ff7ab33dc35b6093cbcd27092a2c3aa7a6e8e985c194dbe9b68

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySun Life Assurance Company of Canada

Victim entitySun Life Assurance Company of Canada

Incidentdiscovered Jun 22, 2023

Stated responseEngaged its internal Cybersecurity Incident Management process

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov