Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsCustomer Data InvolvedTargetedEmploymentFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

UNITED OF OMAHA LIFE INSURANCE COMPANY

bd_d12bf3dd13d902af · schema v1 · pii pii-v1

Severity

High

Discovered

Apr 23, 2024

Filed

Jul 26, 2024

To disclose

13 weeks

Affected

1,089state residents only

Linked

6 filings

Confidence

70%

Full breach record for UNITED OF OMAHA LIFE INSURANCE COMPANY →

United of Omaha Life Insurance Company reported a phishing incident in Washington affecting 1,089 residents. Unauthorized access to an employee email account occurred April 21-23, 2024. Data potentially accessed included names, DOB, SSN, driver's license, and health info. The company reset passwords, hired forensic experts, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✗ WA AG >90d13 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 13 weeks / 94 days

Apr 21, 2024

Begins

Apr 23, 2024

Discovered

Jul 26, 2024

Filed

vs. sector median

+5 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Indiana State AGbd_27ab52e41d0da6d12024-07-26Verified
Massachusetts State AGbd_4780b9e56717780e2024-07-26Verified
HHS OCRbd_b2811bfe98a364362024-07-26Verified
California State AGbd_d1833f07d538c59d2024-07-26Verified

Show 1 more filing ↓up to 25d gap

Illinois State AGbd_c62990a53575cacb2024-07-01 · +25dCandidate

Name: UNITED OF OMAHA LIFE INSURANCE COMPANY
norm: united of omaha life insurance

Name: UNITED OF OMAHA LIFE INSURANCE COMPANY
norm: united of omaha life insurance
Industry: Financial Servicesllm

Discovered: Apr 23, 2024
Breach occurred: Apr 21, 2024 – Apr 23, 2024
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,089state-resident count only
Data types: Identity (basic)Government IDFinancial accountHealth (basic)Employment
Data elements: NameSocial Security numberDriver's licence numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: phishing_link

During the incident: Changed the employee’s Microsoft account passwords to prevent further access to the email account
Hired independent and industry-leading cybersecurity and data analysis experts to assist in the investigation
Reported the fraudulent domain associated with the attack
Re-trained all employees on how to identify and report phishing campaigns
Changes made: Re-trained all employees on how to identify and report phishing campaigns
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: WA AG >90d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Illinois State AGJul 1 · first

Indiana State AG+25d

Massachusetts State AG+25d

HHS OCR+25d

California State AG+25d

Washington State AG+25d · this page

Pattern: first filing Jul 1 (IL), last Jul 26 (WA) — a 25-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA29966.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2024
Raw hash: f0771bc2bb826984a438439af679304a33ee6f3466f748da6f34ce6950373ce1

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityUNITED OF OMAHA LIFE INSURANCE COMPANY

Victim entityUNITED OF OMAHA LIFE INSURANCE COMPANY

Incidentdiscovered Apr 23, 2024

Stated responseChanged the employee’s Microsoft account passwords to prevent further access to the email account

ComplianceWA AG >90d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com