HackingFinancial ServicesFinanceVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

LUMICO LIFE INSURANCE COMPANY

bd_d6bf8fde23a83ea1 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 19, 2023

Filed

Jul 26, 2023

To disclose

5 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

65%

Full breach record for LUMICO LIFE INSURANCE COMPANY →2 incidents on file

Lumico Life Insurance Company disclosed a breach involving its third-party vendor, NTT Data Services, and sub-vendor Pension Benefits Information, LLC. Between May 29-30, 2023, attackers exploited a vulnerability in MOVEit Transfer software to access policyholder data. Lumico discovered the incident on June 19, 2023, and confirmed data acquisition on June 30, 2023. Affected data includes names, SSNs, dates of birth, addresses, and policy numbers. Lumico engaged Kroll for two years of credit monitoring and notified regulators and law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 21 days

discovery → filing · 5 weeks / 37 days

May 29, 2023

Begins

Jun 19, 2023

Discovered

Jul 26, 2023

Filed

vs. sector median

3 wks faster

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Washington State AGbd_edf05202d53296222023-07-27 · +1dVerified
Indiana State AGbd_9d4ecdb86f3319ff2023-07-28 · +2dVerified
South Carolina State AGbd_2c84a71aabc7f8e42023-08-01 · +6dVerified
California State AGbd_60ed3513a32e4a462023-08-01 · +6dVerified

Show 4 more filings ↓up to 19d gap

Massachusetts State AGbd_8db61e50e539b92a2023-08-01 · +6dVerified
Delaware State AGbd_f409b232fcffae5c2023-07-16 · +10dCandidate
Hawaii State AGbd_157503e1142976682023-08-08 · +13dVerified
Oregon State AGbd_a4bb1ffa233d029e2023-08-14 · +19dVerified

Name: LUMICO LIFE INSURANCE COMPANY
norm: lumico life insurance

Name: LUMICO LIFE INSURANCE COMPANY
norm: lumico life insurance
Industry: Financial Servicesllm

Discovered: Jun 19, 2023
Breach occurred: May 29, 2023 – May 30, 2023
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 28, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPII
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: notified relevant state regulators and federal law enforcement authorities
Initial access: exploit_public_facing

During the incident: Activated our incident response protocols
Took prompt steps to ensure the ongoing security of our policyholder information
Secured the services of Kroll to provide identity monitoring at no cost to you for two years
Notified relevant state regulators and federal law enforcement authorities
Changes made: PBI completed the recommended patching and remediation steps to secure its systems
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(37 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 8 states

View merged incident ↗

Delaware State AGJul 16 · first

Delaware State AG+10d · this page

Washington State AG+11d

Indiana State AG+12d

South Carolina State AG+16d

California State AG+16d

Massachusetts State AG+16d

Hawaii State AG+23d

Oregon State AG+29d

Pattern: first filing Jul 16 (DE), last Aug 14 (OR) — a 29-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/07/Lumico_Sample-Consumer-Notice-07.28.2023.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 26, 2023
Raw hash: 5f42d0a3e1126fe930d5e3fb903d8f8275b3197034fcf2178cd19011ebdc50ca

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityLUMICO LIFE INSURANCE COMPANY

Victim entityLUMICO LIFE INSURANCE COMPANY

Incidentdiscovered Jun 19, 2023

Stated responseActivated our incident response protocols

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov