HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)MediumContained

VALIC Retirement Services Company

bd_cdefdfbe10f7165e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 5, 2023

Filed

Jul 31, 2023

To disclose

8 weeks

Affected

1,790state residents only

Linked

2 filings

Confidence

66%

Full breach record for VALIC Retirement Services Company →

VALIC Retirement Services Company, a subsidiary of Corebridge Financial, notified the NH Attorney General of a third-party breach involving its service provider, Pension Benefit Information, LLC (PBI). PBI was affected by the MOVEit zero-day vulnerability, allowing an unauthorized third party to access and download data from May 29-30, 2023. Approximately 1,790 New Hampshire residents were affected. Corebridge suspended data transmissions to PBI upon learning of the incident on June 5, 2023. PBI offered credit monitoring and identity restoration services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 7 days

discovery → filing · 8 weeks / 56 days

May 29, 2023

Begins

Jun 5, 2023

Discovered

Jul 31, 2023

Filed

vs. sector median

on median

This filing is one of 2 about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Maine State AGbd_fdc25383f4e7613c2023-07-31Candidate

Name: VALIC Retirement Services Company
norm: valic retirement

Name: VALIC Retirement Services Company
norm: valic retirement
Industry: Financial Servicesllm

Discovered: Jun 5, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,790state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General's Consumer Protection Bureau
Third party: via Pension Benefit Information, LLC
Initial access: exploit_public_facing

During the incident: Suspended all transmissions of data to PBI
PBI notified law enforcement
PBI patched servers
PBI investigated and assessed the security of its systems
PBI notified potentially affected customers and individuals
PBI is reviewing and enhancing its information security policies and procedures
PBI is offering complimentary credit monitoring, fraud consultation, and identity restoration services through Kroll
Changes made: PBI promptly launched an investigation into the nature and scope of the MOVEit vulnerability’s impact on our systems
PBI is reviewing and enhancing its information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Maine State AGJul 31 · first

New Hampshire State AGJul 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/valic-retirement-services-20230731.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 31, 2023
Raw hash: 07377c8cd346f5f238a04fc639976c1e0e06c071461dff45068784319432529a

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityVALIC Retirement Services Company

Victim entityVALIC Retirement Services Company

Incidentdiscovered Jun 5, 2023

Stated responseSuspended all transmissions of data to PBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov