MalwareFinancial ServicesFinanceRansomwareSupply Chain (3P Vendor)Data EncryptedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDMediumContained

Massachusetts Mutual Life Insurance Company

bd_d918850cbbde809b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 6, 2023

Filed

Mar 21, 2024

To disclose

19 weeks

Affected

39state residents only

Linked

7 filings

Confidence

66%

Full breach record for Massachusetts Mutual Life Insurance Company →48 incidents on file

MassMutual notified the Idaho AG of a ransomware incident affecting 39 Idaho residents. The breach occurred on Nov 2, 2023, at Infosys McCamish Systems (IMS), a third-party provider for Newport Group, MassMutual's recordkeeper. MassMutual was notified on Nov 6, 2023. Affected data includes names, SSNs, addresses, and dates of birth. IMS engaged Unit 42 for remediation and EY for e-discovery. No evidence of data misuse was found. Identity protection services are being offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 19 weeks / 136 days

Nov 2, 2023

Begins

Nov 6, 2023

Discovered

Mar 21, 2024

Filed

vs. sector median

+11 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of INFOSYS MCCAMISH SYSTEMS, LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_85ef8cbd804f27f02024-03-21Verified
Indiana State AGbd_ac0b6dc3df0c296e2024-03-21Candidate
California State AGbd_de5ae1ceb3f549ee2024-03-21Verified
Massachusetts State AGbd_4438a761e0f08cb82024-04-25 · +35dVerified

Show 2 more filings ↓up to 36d gap

Indiana State AGbd_bdbff42b2e4ac7372024-04-26 · +36dCandidate
Massachusetts State AGbd_c08b3d8f474ffdb22024-04-26 · +36dVerified

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance
Industry: Financial Servicesllm

Discovered: Nov 6, 2023
Breach occurred: Nov 2, 2023
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 21, 2024
Affected individuals: 39state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified Idaho Attorney General's Office
Third party: via Infosys McCamish Systems

During the incident: Engaged a leading third-party security expert, Unit 42, part of Palo Alto Networks, to validate the scope of the incident and handle remediation
Engaged a leading e-discovery firm, EY, to determine what data was present on the system at the time of the incident
Offering a complimentary two-year identity protection package through Experian, called IdentityWorks
Changes made: Successfully restored and rebuilt its environment
Validated that the IMS environment has been hardened
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(136 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 4 states

View merged incident ↗

Massachusetts State AGMar 21 · first

Indiana State AGMar 21 · first

California State AGMar 21 · first

Idaho State AGMar 21 · first · this page

Massachusetts State AG+35d

Indiana State AG+36d

Massachusetts State AG+36d

Pattern: first filing Mar 21 (MA), last Apr 26 (MA) — a 36-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.ag.idaho.gov/content/uploads/2024/03/3-21-2024-Massachusetts-Mutual-Life-Insurance-Company.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 21, 2024
Raw hash: fbc0bbaaf8258a84c756b682e2249af7ba5a5bb25f4eed97a38e5e4486386a44

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityMassachusetts Mutual Life Insurance Company

Victim entityMassachusetts Mutual Life Insurance Company

Incidentdiscovered Nov 6, 2023

Stated responseEngaged a leading third-party security expert, Unit 42, part of Palo Alto Networks, to validate the scope of the incident and handle remediation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.ag.idaho.gov