HackingFinancial ServicesFinanceVulnerability ExploitStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Delaware Life

bd_a2dc163aa1d246e3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 1, 2019

Filed

Jun 24, 2019

To disclose

12 weeks

Affected

107state residents only

Confidence

66%

Full breach record for Delaware Life →5 incidents on file

Delaware Life Insurance Company notified the NH Attorney General that a third-party vendor, Mediant Communications, suffered a breach on April 1, 2019, when an unknown malicious party exploited a vulnerability in Mediant's email software to access four business email accounts. The incident affected 107 New Hampshire residents, exposing names, addresses, dates of birth, Social Security numbers, and account/policy numbers. Mediant engaged forensic investigators, contained the incident by disconnecting servers, and reported to the FBI. Delaware Life sent notices on June 19, 2019, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

Apr 1, 2019

Begins

Apr 1, 2019

Discovered

Jun 24, 2019

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed107 affectedView incident

Name: Delaware Life
norm: delaware life
Domain: delawarelife.com

Name: Delaware Life
norm: delaware life
Domain: delawarelife.com
Industry: Financial Servicesllm

Discovered: Apr 1, 2019
Breach occurred: Apr 1, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 19, 2019
Affected individuals: 107state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified New Hampshire Attorney GeneralReported the matter to the Federal Bureau of Investigation
Third party: via Mediant Communications, Inc.
Initial access: exploit_public_facing

During the incident: Disconnected the affected email server from its system
Commenced an investigation to understand the nature and scope of the incident
Engaged digital forensics firm Ankura Consulting Group to investigate the incident
Reported the matter to the Federal Bureau of Investigation
Required affected employees to change their passwords
Sent notices to impacted New Hampshire customers on June 19, 2019
Arranged to make credit monitoring and identity protection services available to them at no cost for two (2) years
Changes made: Remediating the vulnerability in the current email system
Implementing targeted network access restrictions
Updating networking monitoring systems
Accelerating planned improvements to its email system
Updating its network security controls and email system
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/delaware-life-insurance-20190624.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2019
Raw hash: ec6f36f13a2dd06a2410f0add0270f84023cd6a11f98debc14c08de111baa75a

Reporting entityDelaware Life

Victim entityDelaware Life

Incidentdiscovered Apr 1, 2019

Stated responseDisconnected the affected email server from its system

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov