HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

METROPOLITAN LIFE INSURANCE CO

bd_b8dbb0cdd9b101a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 22, 2024

Filed

Aug 27, 2024

To disclose

27 weeks

Affected

Not disclosed

Linked

6 filings

Confidence

67%

Full breach record for METROPOLITAN LIFE INSURANCE CO →46 incidents on file

Metropolitan Life Insurance Company notified Delaware residents of a data breach involving a third-party service provider. The provider's network was intruded upon starting February 22, 2024, potentially exposing names, DOBs, policy numbers, and SSNs of MetLife retirement plan customers. MetLife offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 weeks / 187 days

Feb 22, 2024

Discovered

Aug 27, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_7bbd29fab54c45072024-08-27Verified
Montana State AGbd_faf3aa9b40c53bb72024-08-28 · +1dVerified
Maine State AGbd_60c1157313c165fe2024-08-26 · +1dCandidate
Massachusetts State AGbd_0628c89b51b321c22024-08-29 · +2dVerified

Show 1 more filing ↓up to 2d gap

Texas State AGbd_9fb330886330758f2024-08-29 · +2dVerified

Name: METROPOLITAN LIFE INSURANCE CO
norm: metropolitan life insurance
Domain: metlife.com

Name: METROPOLITAN LIFE INSURANCE CO
norm: metropolitan life insurance
Domain: metlife.com
Industry: Financial Servicesllm

Discovered: Feb 22, 2024
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Arranged for you to enroll, at no cost to you, in an online three-bureau credit monitoring service (myTrueIdentity) for one year
Changes made: Service provider secured its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(187 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGAug 26 · first

Indiana State AG+1d

Delaware State AG+1d · this page

Montana State AG+2d

Massachusetts State AG+3d

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2024/09/Generic-Individual-Notification-Letter_1yrCM_1714-FNL.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 27, 2024
Raw hash: d96c6c3b4f1805aedf6d81b660114927d3e349b7d083de71bbc8d8aa7096ec5e

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMETROPOLITAN LIFE INSURANCE CO

Victim entityMETROPOLITAN LIFE INSURANCE CO

Incidentdiscovered Feb 22, 2024

Stated responseArranged for you to enroll, at no cost to you, in an online three-bureau credit monitoring service (myTrueIdentity) for one year

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov