Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsData ExfiltratedCustomer Data InvolvedTargetedIdentity (basic)Government IDPIIMediumContained

Oxford Life Insurance Company

bd_c0e380bef0dfa0cd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 20, 2025

Filed

May 13, 2025

To disclose

12 weeks

Affected

30state residents only

Linked

10 filings

Confidence

66%

Full breach record for Oxford Life Insurance Company →

Oxford Life Insurance Company reported a social engineering attack in Maine affecting 30 residents. The breach occurred on Feb 20, 2025, when an attacker impersonated a collections company to gain network access. Data exposed included names and SSNs. Notifications were sent on May 13, 2025, with credit monitoring offered.

J jump to incidentP pin to compareR raw source

Maine clockScope identified Apr 18, 2025 → Filed with AG May 13, 202525d ✓ ME AG ≤30d12 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 12 weeks / 82 days

Feb 20, 2025

Begins

Feb 20, 2025

Discovered

May 13, 2025

Filed

vs. sector median

+4 wks slower

This filing is one of 10 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

Oregon State AGbd_3a128a8f2d1960ba2025-05-13Candidate
New Hampshire State AGbd_5e970293d82ec38f2025-05-13Verified
California State AGbd_b38782347f2f48272025-05-13Verified
Indiana State AGbd_caddaa76c0f31e1b2025-05-13Verified

Show 5 more filings ↓up to 12d gap

Iowa State AGbd_d8a02c85b483331d2025-05-13Verified
Nebraska State AGbd_e20a3b3413f499c42025-05-13Verified
Massachusetts State AGbd_109cc1d5dea430c52025-05-14 · +1dVerified
Vermont State AGbd_7629781055bba1982025-05-14 · +1dVerified
Illinois State AGbd_795beed524dd67242025-05-01 · +12dVerified

Name: Oxford Life Insurance Company
norm: oxford life insurance
Domain: oxfordlife.com

Name: Oxford Life Insurance Company
norm: oxford life insurance
Domain: oxfordlife.com
Industry: Financial Servicesllm

Discovered: Feb 20, 2025
Scope identified: Apr 18, 2025Maine’s notice clock starts here (10 M.R.S. §1348(1))The letter says: “Oxford reviewed the files that may have been involved, which was substantially completed on April 18, 2025. Through this review, Oxford identified files containing information belonging to certain individuals associated with Oxford, such as policyholders, claimants, and insurance agents, residing in Maine.”
Breach occurred: Feb 20, 2025 – Feb 20, 2025
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 13, 2025
Affected individuals: 30state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Filed notification with Maine Attorney General
Initial access: phishing_link

During the incident: Initiated incident response protocols
Began an investigation with the assistance of a third-party forensic firm
Took measures to contain the activity
Sent notifications via U.S. First-Class mail
Offered one year of complimentary credit monitoring, fraud consultation, and identity theft restoration services through Experian
Established a dedicated, toll-free call center
Changes made: Implemented additional safeguards and technical security measures to further protect and monitor its systems
Continuing to enhance its education and testing of employees about phishing and social engineering scams
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: ME AG ≤30d · 25d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Scope identified: Apr 18, 2025
→ Filed with AG: May 13, 2025
25d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Scope identified: Apr 18, 2025 → Filed with AG: May 13, 2025	25d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 10 states

View merged incident ↗

Illinois State AGMay 1 · first

Oregon State AG+12d

New Hampshire State AG+12d

California State AG+12d

Indiana State AG+12d

Iowa State AG+12d

Nebraska State AG+12d

Maine State AG+12d · this page

Massachusetts State AG+13d

Vermont State AG+13d

Pattern: first filing May 1 (IL), last May 14 (VT) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/04a4c60b-2fb6-4d9b-9041-81d1fd4fa09f.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2025
Raw hash: bccc67ebbaec933b6c465a8a87dc8701e36105e69f74fd4ff2074e91ddde2f4a

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityOxford Life Insurance Company

Victim entityOxford Life Insurance Company

Incidentdiscovered Feb 20, 2025

Stated responseInitiated incident response protocols

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov