HackingFinancial ServicesFinanceVulnerability ExploitCapture Stored DataCL0PZero-DayData ExfiltratedSupply Chain (3P Vendor)Customer Data InvolvedTargetedIdentity (basic)Government IDPIICVE-2023-34362HighResolved

TALCOTT RESOLUTION LIFE INSURANCE COMPANY

bd_aba190fcbb817b31 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 4, 2023

Filed

Jun 28, 2023

To disclose

24 days

Affected

12,525state residents only

Linked

9 filings

Confidence

70%

Full breach record for TALCOTT RESOLUTION LIFE INSURANCE COMPANY →4 incidents on file

Talcott Resolution Life Insurance Company reported a third-party vendor breach involving PBI Research Services. The CL0P group exploited a zero-day vulnerability (CVE-2023-34362) in MOVEit Transfer to exfiltrate customer PII (name, DOB, SSN, policy number) from May 29-30, 2023. Talcott was notified on June 4, 2023. 12,525 Washington residents were affected. Notifications were sent July 19, 2023. Incident is resolved.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d24 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 6 days

discovery → filing · 24 days

May 29, 2023

Begins

Jun 4, 2023

Discovered

Jun 28, 2023

Filed

vs. sector median

7 wks faster

This filing is one of 9 filings about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_c5c4d8d4a7f415ac2023-06-28Verified
Massachusetts State AGbd_10f404ece672e13b2023-06-27 · +1dVerified
California State AGbd_3587cc17d4719a402023-06-27 · +1dCandidate
Oregon State AGbd_9d9397e4ee2274822023-06-27 · +1dVerified

Show 4 more filings ↓up to 34d gap

Indiana State AGbd_7bd62d94c616b5872023-07-10 · +12dVerified
Montana State AGbd_eced2b5c5a3a60f52023-07-18 · +20dVerified
Maine State AGbd_eca292e37aaf4cbb2023-07-25 · +27dVerified
New Hampshire State AGCL0Pbd_7eb5a317800d59e02023-08-01 · +34dVerified

Name: TALCOTT RESOLUTION LIFE INSURANCE COMPANY
norm: talcott resolution life insurance
Domain: talcottresolution.com

Name: TALCOTT RESOLUTION LIFE INSURANCE COMPANY
norm: talcott resolution life insurance
Domain: talcottresolution.com
Industry: Financial Servicesllm

Discovered: Jun 4, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 19, 2023
Affected individuals: 12,525state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain· CL0P
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: CL0PExternalFinancial
Regulator citations: Notified primary insurance regulators beginning June 8Continue to notify and update other regulators
Third party: via PBI Research Services
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: PBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
PBI conducted a manual review of our records to confirm the identities of individuals potentially affected
PBI mailed a total of 12,877 written notifications and offers of complimentary identity theft protection and credit monitoring to Washington residents
PBI patched all known vulnerabilities in MOVEit Transfer
PBI adopted additional safeguards to prevent future unauthorized access to consumer data
Changes made: PBI patched all known vulnerabilities in MOVEit Transfer
PBI adopted additional safeguards to prevent future unauthorized access to consumer data
Offering 12 months of complimentary credit monitoring and identity restoration services through Kroll
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Massachusetts State AGJun 27 · first

California State AGJun 27 · first

Oregon State AGJun 27 · first

Massachusetts State AG+1d

Washington State AG+1d · this page

Indiana State AG+13d

Montana State AG+21d

Maine State AG+28d

New Hampshire State AG+35d

Pattern: first filing Jun 27 (MA), last Aug 1 (NH) — a 35-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA24631.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 28, 2023
Raw hash: 2404f08a88fdb422b561395fe4d458ef9008f38ae7e7bbe3130c8f2129e02724

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityTALCOTT RESOLUTION LIFE INSURANCE COMPANY

Victim entityTALCOTT RESOLUTION LIFE INSURANCE COMPANY

Incidentdiscovered Jun 4, 2023

Stated responsePBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com