AccidentalFinancial ServicesFinanceMisdeliveryCustomer Data InvolvedIdentity (basic)PIIMediumResolved

Mutual of America Life Insurance Co.

bd_cceccc61e628b5cb · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 9, 2023

Filed

Feb 5, 2023

To disclose

27 days

Affected

1,043state residents only

Confidence

70%

Full breach record for Mutual of America Life Insurance Co. →4 incidents on file

Mutual of America Life Insurance Company notified Washington AG of an error where customer PII (name, address, DOB) was visible through oversized envelope windows on mailed forms. Incident occurred Aug 25, 2022 – Jan 13, 2023; discovered Jan 9, 2023. 1,043 WA residents affected. Company discontinued mailings, implemented cover pages, and offered 12 months of identity theft protection.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d27 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 137 days

discovery → filing · 27 days

Aug 25, 2022

Begins

Jan 9, 2023

Discovered

Feb 5, 2023

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,043 affectedView incident

Name: Mutual of America Life Insurance Co.
norm: mutual of america life insurance
Domain: mutualofamerica.com

Name: Mutual of America Life Insurance Co.
norm: mutual of america life insurance
Domain: mutualofamerica.com
Industry: Financial Servicesllm

Discovered: Jan 9, 2023
Breach occurred: Aug 25, 2022 – Jan 13, 2023
Undetected for: 137 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 6, 2023
Affected individuals: 1,043state-resident count only
Data types: Identity (basic)PII
Data elements: NameDate of birth
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 100-199dexposure 100-199d
WA-stated discovery: Found while ongoing
Attack vector: Misconfiguration
Regulator citations: Notified Washington Attorney General

During the incident: Temporarily discontinued mailing these forms
Implemented corrective measures including a cover page to fully conceal all information
Offered complementary identity theft detection and resolution services for twelve months
Changes made: Inserted a cover page to fully conceal all information present on the two forms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA19718.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 5, 2023
Raw hash: 65b16888e64bd1b0bf2a78ee4943d6c8dabdc3a77e273bcb7b4dc36150a294fe

Reporting entityMutual of America Life Insurance Co.

Victim entityMutual of America Life Insurance Co.

Incidentdiscovered Jan 9, 2023

Stated responseTemporarily discontinued mailing these forms

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com