HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
NASSAU LIFE AND ANNUITY COMPANY
bd_b69424490ab506fe · schema v1 · pii pii-v1
Full breach record for NASSAU LIFE AND ANNUITY COMPANY →Pension Benefit Information, LLC (PBI) notified the California AG of a data breach involving its third-party software provider, Progress Software (MOVEit Transfer). An unauthorized third party exploited a vulnerability in MOVEit to access PBI's servers on May 29-30, 2023, and downloaded data. PBI discovered the vulnerability disclosure on May 31, 2023. Affected data includes names and other basic identity information. PBI patched servers, investigated the scope, and is offering 24 months of credit monitoring via Kroll.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_7c59f9490944b86aOregon State AGfiled 2023-08-31Candidate
- bd_f5f48893d20dd736Montana State AGfiled 2023-08-31Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-572690
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 31, 2023
- Raw hash
- 8a2733d8b75939f6442d0ac383b8fa73d93ef8c76b531480603e2ca3c14b91b0
Reporting entity
- Name
- NASSAU LIFE AND ANNUITY COMPANYnorm: nassau life and annuity
Victim entity
- Name
- NASSAU LIFE AND ANNUITY COMPANYnorm: nassau life and annuity
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 13 weeks(92 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.