HackingProfessional ServicesFinancial ServicesProfessional ServicesVulnerability ExploitZero-DaySupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDCVE-2023-34362MediumContained

MILLIMAN, INC.

bd_d1cb5766b2805d52 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 31, 2023

Filed

Aug 14, 2023

To disclose

11 weeks

Affected

869state residents only

Linked

10 filings

Confidence

65%

Full breach record for MILLIMAN, INC. →5 incidents on file

Milliman, Inc. notified the Idaho Attorney General of a data breach involving its third-party vendor, Pension Benefit Information, LLC (PBI). PBI's MOVEit Transfer software was exploited via zero-day vulnerability CVE-2023-34362 between May 29-30, 2023. The incident affected 869 Idaho residents, exposing names, addresses, dates of birth, and Social Security numbers. PBI patched the vulnerability and offered 24 months of credit monitoring. Milliman halted data transfers to PBI and is reviewing vendor security practices.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 2 days

discovery → filing · 11 weeks / 75 days

May 29, 2023

Begins

May 31, 2023

Discovered

Aug 14, 2023

Filed

vs. sector median

4 wks faster

This filing is one of 10 filings about the same incident.View merged incident

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (9) · sorted by filing gap

California State AGbd_5fb2b809a54c9f682023-08-14Verified
Indiana State AGbd_61914e30e6a7f2e72023-08-14Verified
Massachusetts State AGbd_6f1acd087e5dc3602023-08-14Verified
Maine State AGbd_847189c2c427ed3b2023-08-14Candidate

Show 5 more filings ↓up to 4d gap

Washington State AGbd_b71e461fa51aa4b22023-08-14Verified
Oregon State AGbd_c290a9c83b4262b52023-08-14Verified
Montana State AGbd_efdfa8d0534820d32023-08-14Verified
New Hampshire State AGbd_0784ee17d069ca5f2023-08-17 · +3dVerified
Maine State AGbd_ef7ad7a4aedf79b12023-08-18 · +4dVerified

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com

Name: MILLIMAN, INC.
norm: milliman
Domain: us.milliman.com
Industry: Professional ServicesllmFinancial Servicesllm

Discovered: May 31, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 14, 2023
Affected individuals: 869state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Submitted notice to Idaho Attorney General’s Office, Consumer Protection Division
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: Stopped transferring data to PBI pending further evaluation of PBI’s information security practices
Evaluating potential vendor management and security enhancements
PBI patched the vulnerability in its MOVEit Transfer software
PBI is reviewing and enhancing its information security policies and procedures
PBI is providing written notification to those individuals on behalf of Milliman and its clients identified herein, which includes an offer for 24 months of cost-free credit monitoring
Changes made: Patching the vulnerability in MOVEit Transfer software
Reviewing and enhancing information security policies and procedures
Evaluating potential vendor management and security enhancements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 10 filings · 9 states

View merged incident ↗

California State AGAug 14 · first

Indiana State AGAug 14 · first

Massachusetts State AGAug 14 · first

Maine State AGAug 14 · first

Washington State AGAug 14 · first

Oregon State AGAug 14 · first

Montana State AGAug 14 · first

Idaho State AGAug 14 · first · this page

New Hampshire State AG+3d

Maine State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2023/08/8-14-2023-Milliman-Inc.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 14, 2023
Raw hash: 229afaa8d4867a51785bdf5de94a3057d6f17dc7952725b15adbefb554503a96

Linked disclosures

Regulatory filings (9) · sorted by filing gap

Reporting entityMILLIMAN, INC.

Victim entityMILLIMAN, INC.

Incidentdiscovered May 31, 2023

Stated responseStopped transferring data to PBI pending further evaluation of PBI’s information security practices

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov