AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDMediumResolved

PRINCIPAL FINANCIAL GROUP, INC.

bd_bb0eac6977f8e2aa · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 3, 2020

Filed

May 7, 2020

To disclose

18 weeks

Affected

14state residents only

Linked

3 filings

Confidence

66%

Full breach record for PRINCIPAL FINANCIAL GROUP, INC. →13 incidents on file

Principal Financial Group notified NH AG of a website coding error where customer PII (name, SSN) was inadvertently displayed to other customers. Issue occurred Nov 23-Dec 16, 2019. Discovered Jan 3, 2020 via customer reports. 14 NH residents affected. No data acquisition or misuse confirmed. Credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 18 weeks / 125 days

Nov 23, 2019

Begins

Jan 3, 2020

Discovered

May 7, 2020

Filed

vs. sector median

+10 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_022abbae2c5f40cd2020-05-07Verified by operator
Montana State AGbd_2e704608dd784f6b2020-04-28 · +9dCandidate

Name: PRINCIPAL FINANCIAL GROUP, INC.
norm: principal financial
Domain: principal.com

Name: PRINCIPAL FINANCIAL GROUP, INC.
norm: principal financial
Domain: principal.com
Industry: Financial Servicesllm

Discovered: Jan 3, 2020
Breach occurred: Nov 23, 2019 – Dec 16, 2019
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Misconfiguration
MITRE ATT&CK: T1119 Automated Collection
Regulator citations: Notified New Hampshire Attorney General

During the incident: Installed new code to fix the issue
Conducted an investigation to determine if additional instances could be identified
Updated testing procedures to account for this scenario
Offered credit monitoring services to affected participants
Changes made: Updated testing to account for this exact scenario
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 weeks(125 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGApr 28 · first

Washington State AG+9d

New Hampshire State AG+9d · this page

Pattern: first filing Apr 28 (MT), last May 7 (NH) — a 9-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/principal-financial-group-20200507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 7, 2020
Raw hash: a0e0ace945239363b2e4e12eaad4a7c1e5a9fca68d2fb313ababfae319f4755c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPRINCIPAL FINANCIAL GROUP, INC.

Victim entityPRINCIPAL FINANCIAL GROUP, INC.

Incidentdiscovered Jan 3, 2020

Stated responseInstalled new code to fix the issue

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov