HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Delayed DiscoveryCustomer Data InvolvedLow

The Northwestern Mutual Life Insurance Company

bd_c10226bc49582173 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 24, 2024

Filed

Feb 7, 2024

To disclose

14 days

Affected · nationwide

8871 in this filing

Linked

16 filings

Confidence

65%

Full breach record for The Northwestern Mutual Life Insurance Company →22 incidents on file

The Northwestern Mutual Life Insurance Company reported a data breach impacting 887 individuals that occurred due to a breach at a third-party service provider. The incident took place between October 29, 2023, and November 2, 2023, and was discovered on January 24, 2024. Affected individuals were notified on February 7, 2024, and offered 12 months of identity protection services through Experian.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 24, 2024 → Filed with AG Feb 7, 202414d ✓ ME AG ≤30d14 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 87 days

discovery → filing · 14 days

Oct 29, 2023

Begins

Jan 24, 2024

Discovered

Feb 7, 2024

Filed

vs. sector median

8 wks faster

This filing is one of 16 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_2f40c7ba9b1e8a512024-02-16 · +9dVerified
Massachusetts State AGbd_33933653706e0f642024-02-16 · +9dVerified
Maine State AGbd_569adbdb9e453b182024-02-16 · +9dVerified
Montana State AGbd_fa687827ad46b0a52024-02-16 · +9dVerified

Show 6 more filings ↓up to 30d gap

Montana State AGbd_3c2a297f228ab4702024-02-29 · +22dVerified
Maine State AGbd_604c26d3099e3fe92024-02-29 · +22dVerified
Massachusetts State AGbd_bfc4408712b72fa62024-02-29 · +22dVerified
Oregon State AGbd_f32704b1d1b017c12024-02-29 · +22dVerified
Indiana State AGbd_7f405322cd8b7cd62024-03-01 · +23dVerified
New Hampshire State AGbd_c86992b6fc6b6a8c2024-03-08 · +30dVerified

Showing first 10 of 15 linked disclosures.

Name: The Northwestern Mutual Life Insurance Company
norm: the northwestern mutual life insurance
Domain: northwesternmutual.com

Name: The Northwestern Mutual Life Insurance Company
norm: the northwestern mutual life insurance
Domain: northwesternmutual.com
Industry: Financial Services
Industry: Financial Servicesllm

Discovered: Jan 24, 2024
Breach occurred: Oct 29, 2023 – Nov 2, 2023
Undetected for: 87 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 7, 2024
Affected individuals: 887state + nationwide
Data types: —
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Initial access: supply_chain

During the incident: Proactively monitoring and prepared to respond as new information from Vanguard or IMS becomes available.
Changes made: Offering 12 months of identity protection services provided by Experian - IdentityWorks
In the event compromise of personal information is confirmed, Vanguard has agreed to send a supplemental notice letter offering a total of at least 24 months of credit monitoring to all impacted individuals.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: ME AG ≤30d · 14d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 24, 2024
→ Filed with AG: Feb 7, 2024
14d 30 days ME AG ≤30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 24, 2024 → Filed with AG: Feb 7, 2024	14d	30 days	ME AG ≤30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Maine State AGFeb 7 · first · this page

Indiana State AG+9d

Massachusetts State AG+9d

Maine State AG+9d

Montana State AG+9d

Montana State AG+22d

Maine State AG+22d

Massachusetts State AG+22d

Oregon State AG+22d

Indiana State AG+23d

New Hampshire State AG+30d

Pattern: first filing Feb 7 (ME), last Mar 8 (NH) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f6991d9a-171c-4658-b880-cfd043802263.shtml
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 7, 2024
Raw hash: 69ae29d1dea8668c36b49b666b692f0a02b36eac31a99df7f193ae4b158895ea

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Northwestern Mutual Life Insurance Company

Victim entityThe Northwestern Mutual Life Insurance Company

Incidentdiscovered Jan 24, 2024

Stated responseProactively monitoring and prepared to respond as new information from Vanguard or IMS becomes available.

ComplianceME AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov