HackingHealthcareFinancial ServicesHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)MediumContained

Massachusetts Mutual Life Insurance Company

bd_d9fd5a872ef1c86b · schema v1 · pii pii-v2

Severity

Medium

Discovered

Jan 15, 2025

Filed

Dec 11, 2025

To disclose

—

Affected

2state residents only

Linked

3 filings

Confidence

66%

Full breach record for Massachusetts Mutual Life Insurance Company →48 incidents on file

Massachusetts Mutual Life Insurance Company reported a data breach involving its third-party vendor, Conduent Business Services, LLC. Unauthorized access to Conduent's systems occurred between October 21, 2024, and January 13, 2025. The incident impacted two Nebraska residents, exposing names, health care IDs, dates of service, treatment costs, claim numbers, and Social Security numbers. Cigna, the plan administrator, notified MassMutual on October 9, 2025. Remediation included engaging forensic firms, resetting passwords, and providing 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 86 days

Oct 21, 2024

Begins

Jan 15, 2025

Discovered

Dec 11, 2025

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_7b71914f92a5b0482025-12-11Candidate
Massachusetts State AGbd_335e93ab712e4c662025-12-04 · +7dVerified

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance

Name: Massachusetts Mutual Life Insurance Company
norm: massachusetts mutual life insurance
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 15, 2025
Breach occurred: Oct 21, 2024 – Jan 13, 2025
Undetected for: 86 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 4, 2025
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Nebraska Attorney General's Office
Initial access: supply_chain

During the incident: Took all systems offline
Engaged multiple third-party forensics firms to perform an investigation
Scanned its environment to ensure the threat actor had been removed
Rebuild and harden the systems affected
Deploy and validate endpoint detection software and multi-factor authentication across its endpoints
Reset administrator passwords
Changes made: Transitioned services to other vendors, reducing this vendors role in Cigna Healthcare's operations
Periodic security assessments
Ensuring appropriate privacy and security controls
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Massachusetts State AGDec 4 · first

Indiana State AG+7d

Nebraska State AG+7d · this page

Pattern: first filing Dec 4 (MA), last Dec 11 (NE) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/0b4983ac-642e-42ce-8fea-c72d59858c94.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 11, 2025
Raw hash: ae0ad3c1d1d5bd7c5ca32704e39acd8825cb82bd081b48d6ef9c6e75cfb222c4

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMassachusetts Mutual Life Insurance Company

Victim entityMassachusetts Mutual Life Insurance Company

Incidentdiscovered Jan 15, 2025

Stated responseTook all systems offline

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov