HackingVulnerability ExploitZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTCVE-2023-34362MediumContained
TRANE TECHNOLOGIES COMPANY LLC
bd_a7042ebcd6adfa1b · schema v1 · pii pii-v1
Full breach record for TRANE TECHNOLOGIES COMPANY LLC →On or around May 29-30, 2023, an unauthorized third party exploited a zero-day vulnerability (CVE-2023-34362) in Progress Software's MOVEit Transfer software, accessed by third-party vendor Pension Benefit Information, LLC (PBI). PBI stored data for client Trane Technologies. The actor downloaded personal information, including names, addresses, dates of birth, and Social Security numbers, of one Idaho resident. Trane Technologies and Milliman notified the Idaho Attorney General on August 18, 2023, and offered 24 months of credit monitoring.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident
Source provenance
- Source URL
- https://www.ag.idaho.gov/content/uploads/2023/08/8-18-2023-Trane-Technologies.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 18, 2023
- Raw hash
- 37c1d9e5c437457208e44cf60c5bda7eaec82786cf81741f01c115aad81f12bd
Reporting entity
- Name
- MILLIMAN, INC.norm: milliman
Victim entity
- Name
- TRANE TECHNOLOGIES COMPANY LLCnorm: trane technologies
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Aug 18, 2023
- Affected individuals
- 1
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Submitted notice to Idaho Attorney General’s Office Consumer Protection Division
- Initial access
- exploit_public_facing
- CVE references
Compliance
- Time to disclose
- 11 weeks(79 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.