Athene Annuity and Life Company and its affiliates
bd_a1e18d6a91a9c264 · schema v1 · pii pii-v1
Full breach record for Athene Annuity and Life Company and its affiliates →Pension Benefit Information, LLC (PBI) notified the California AG of a data breach involving its MOVEit Transfer software. An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer, accessing PBI's servers on May 29-30, 2023, and downloading data. PBI discovered the issue on May 31, 2023, when Progress disclosed the vulnerability. Affected data includes personal information of individuals associated with Global Atlantic Financial Group policies. PBI patched servers, investigated the scope, and is offering credit monitoring via Experian. The incident is contained.
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_a61e1b257e771444Oregon State AGfiled 2023-09-18Verified
- bd_0b2433a9bf13981dMaine State AGfiled 2023-07-20(60d gap)Verified
- bd_2122d1ad58be678cCalifornia State AGfiled 2023-07-20(60d gap)Candidate
- bd_4774c894ba19f11eOregon State AGfiled 2023-07-20(60d gap)Verified
Show 1 more filing ↓Show fewer ↑up to 60d gap
- bd_9def23da88b251ffWashington State AGfiled 2023-07-20(60d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-573471
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 18, 2023
- Raw hash
- 05d98d57b5b7f7bc9da29dbd3d49b742a274295885beea8dace327ef5295955c
Reporting entity
- Name
- Athene Annuity and Life Company and its affiliatesnorm: athene annuity and life company and its affiliates
Victim entity
- Name
- Athene Annuity and Life Company and its affiliatesnorm: athene annuity and life company and its affiliates
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 18, 2023
- Affected individuals
- Not disclosed
- Data types
- PIIIDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 16 weeks(110 days from discovery to filing)
- Compliance flags
- CA 60-day late · 79d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 31, 2023→ Notified: Aug 18, 202379d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.