HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

Puritan Life Insurance Company of America

bd_af5df8120dae4c06 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2023

Filed

Sep 5, 2023

To disclose

10 weeks

Affected

7state residents only

Linked

3 filings

Confidence

66%

Full breach record for Puritan Life Insurance Company of America →

Puritan Life Insurance Company of America notified the NH AG of a third-party data breach involving its TPA's subcontractor, PBI Research Services. Attackers exploited a zero-day vulnerability in MOVEit Transfer software to exfiltrate data from May 29-30, 2023. Puritan was notified on June 27, 2023. 7 NH residents were affected. PBI offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 29 days

discovery → filing · 10 weeks / 70 days

May 29, 2023

Begins

Jun 27, 2023

Discovered

Sep 5, 2023

Filed

vs. sector median

+2 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_3273f76d665a5e242023-08-31 · +5dCandidate
Indiana State AGbd_8c4a56c8dec665ce2023-08-31 · +5dVerified

Name: Cipriani & Werner
norm: cipriani werner
Domain: c-wlaw.com

Name: Puritan Life Insurance Company of America
norm: puritan life insurance company of america
Industry: Financial Servicesllm

Discovered: Jun 27, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 31, 2023
Affected individuals: 7state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via NTT Data / PBI Research Services
Initial access: exploit_public_facing

During the incident: PBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
PBI conducted a manual review of our records to confirm the identities of individuals potentially affected
PBI provided written notice of this incident to the potentially impacted New Hampshire residents
PBI is offering you access to complimentary identity monitoring services through Kroll
Changes made: PBI promptly took steps to patch servers
PBI is reviewing and enhancing its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(70 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGAug 31 · first

Indiana State AGAug 31 · first

New Hampshire State AG+5d · this page

Pattern: first filing Aug 31 (MT), last Sep 5 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/puritan-life-insurance-company-america-20230905.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 5, 2023
Raw hash: 9dff6dcd4a97781efc1031a7257b9e38dca4d86e218a03a4c42e202e1c4f958a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCipriani & Werner

Victim entityPuritan Life Insurance Company of America

Incidentdiscovered Jun 27, 2023

Stated responsePBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov