HackingProfessional ServicesProfessional ServicesVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCVE-2023-34362HighContained

MILLIMAN, INC.

bd_b71e461fa51aa4b2 · schema v1 · pii pii-v1

Severity

High

Discovered

May 31, 2023

Filed

Aug 14, 2023

To disclose

11 weeks

Affected

2,879state residents only

Linked

10 filings

Confidence

70%

Full breach record for MILLIMAN, INC. →5 incidents on file

Milliman, Inc. filed a supplemental Washington state AG breach notice (ID 15644) regarding a third-party vendor (PBI) incident involving the MOVEit Transfer zero-day vulnerability (CVE-2023-34362). Unauthorized access occurred May 29-30, 2023. The breach affected 2,879 Washington residents, exposing names, addresses, DOBs, and SSNs. Notifications began August 14, 2023.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d11 weeks discovery → filing

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 75 days

May 29, 2023

Begins

May 31, 2023

Discovered

Aug 14, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_5fb2b809a54c9f682023-08-14Verified
Indiana State AGbd_61914e30e6a7f2e72023-08-14Verified
Massachusetts State AGbd_6f1acd087e5dc3602023-08-14Verified
Maine State AGbd_847189c2c427ed3b2023-08-14Candidate

Show 5 more filings ↓up to 4d gap

Oregon State AGbd_c290a9c83b4262b52023-08-14Verified
Idaho State AGbd_d1cb5766b2805d522023-08-14Verified
Montana State AGbd_efdfa8d0534820d32023-08-14Verified
New Hampshire State AGbd_0784ee17d069ca5f2023-08-17 · +3dVerified
Maine State AGbd_ef7ad7a4aedf79b12023-08-18 · +4dVerified

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com
Industry: Professional Servicesllm

Discovered: May 31, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2023
Affected individuals: 2,879state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: PBI has advised us that it immediately took steps to patch the vulnerability in its MOVEit Transfer software
Milliman has stopped transferring data to PBI pending further evaluation of PBI’s information security practices
Milliman is also evaluating potential vendor management and security enhancements
Changes made: PBI is reviewing and enhancing its information security policies and procedures
Milliman is also evaluating potential vendor management and security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

California State AGAug 14 · first

Indiana State AGAug 14 · first

Massachusetts State AGAug 14 · first

Maine State AGAug 14 · first

Oregon State AGAug 14 · first

Idaho State AGAug 14 · first

Montana State AGAug 14 · first

Washington State AGAug 14 · first · this page

New Hampshire State AG+3d

Maine State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM15644.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2023
Raw hash: 84e90edfb385f0e0e21a0957a8c76d3efd05685cf562e859d9130ae8dabe70ec

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMILLIMAN, INC.

Victim entityMILLIMAN, INC.

Incidentdiscovered May 31, 2023

Stated responsePBI has advised us that it immediately took steps to patch the vulnerability in its MOVEit Transfer software

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com