HackingVulnerability ExploitStolen CredentialsData ExfiltratedCustomer Data InvolvedPIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHighContained
CLEAR SPRING LIFE AND ANNUITY COMPANY
bd_cd8360870bf6d0b8 · schema v1 · pii pii-v1
Full breach record for CLEAR SPRING LIFE AND ANNUITY COMPANY →Clear Spring Life and Annuity Company reported a data breach affecting approximately 10,000 individuals. The incident involved unauthorized access to a network server via an exploited vulnerability and stolen credentials, resulting in the exfiltration of personal information including names, SSNs, and financial account details. The company engaged forensic investigators and offered credit monitoring services.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10,000 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/clear-spring-life-annuity-20230801.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 1, 2023
- Raw hash
- 74c4aecde00e585c973e49700ba12e5232dc16bb449dba5ad4c37eff31de0a7d
Reporting entity
- Name
- CLEAR SPRING LIFE AND ANNUITY COMPANYnorm: clear spring life and annuity
Victim entity
- Name
- CLEAR SPRING LIFE AND ANNUITY COMPANYnorm: clear spring life and annuity
Incident
- Discovered
- Jul 27, 2023
- Materiality determined
- —
- Notification sent
- Aug 1, 2023
- Affected individuals
- 10,000
- Data types
- PIIIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- ExternalFinancial
- Regulator citations
- Filed notice with New Hampshire Department of Justice
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 5 days(5 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.