HackingFinancial ServicesFinanceVulnerability ExploitCapture Stored DataData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Identity (basic)Government IDPIIHighContained

Pension Benefit Information, LLC

bd_cb33801fe16fe55c · schema v1 · pii pii-v1

Severity

High

Discovered

May 31, 2023

Filed

Aug 14, 2023

To disclose

11 weeks

Affected

27,651state residents only

Linked

2 filings

Confidence

66%

Full breach record for Pension Benefit Information, LLC →18 incidents on file

Pension Benefit Information, LLC (PBI) disclosed a third-party software vulnerability incident involving Progress Software's MOVEit Transfer. An unauthorized third party accessed PBI's MOVEit server on May 29-30, 2023, downloading personal information including names, SSNs, DOBs, and policy numbers. PBI notified law enforcement, patched servers, and offered 24 months of credit monitoring. Corebridge Financial was a client of PBI but was not directly breached.

J jump to incidentP pin to compareR raw source

Hawaii clock✓ HI CRA notice due11 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 75 days

May 29, 2023

Begins

May 31, 2023

Discovered

Aug 14, 2023

Filed

vs. sector median

+1 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c00246f70be09e692023-08-16 · +2dVerified

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: mypensionbenefitinformation.com
Industry: Financial Servicesllm

Discovered: May 31, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 27,651state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: PBI has also notified law enforcement about this event
Initial access: exploit_public_facing

During the incident: PBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
Conducted a manual review of our records to confirm the identities of individuals potentially affected
PBI has also notified law enforcement about this event
Promptly took steps to patch servers
Assess the security of our systems
Notify potentially affected customers and individuals
Offering you access to 24 months of complimentary credit monitoring and identity restoration services through Kroll
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: HI CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Hawaii State AGAug 14 · first · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://cca.hawaii.gov/wp-content/uploads/2026/05/Letter.2023-0895.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2023
Raw hash: 1d4d6ae9915eaf1066745cad4aff408c59b7db3963c09f6ca2b2a81f3c271cc5

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPension Benefit Information, LLC

Victim entityPension Benefit Information, LLC

Incidentdiscovered May 31, 2023

Stated responsePBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems

ComplianceHI CRA notice due

Extraction provenanceno artifact recorded

Source provenancecca.hawaii.gov