HackingFinancial ServicesTechnologyFinanceVulnerability ExploitData ExfiltratedTargetedIdentity (basic)MediumContained

Delaware Life

bd_e0c3bb4c604b22a3 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Sep 6, 2023

To disclose

—

Affected

1,141state residents only

Linked

6 filings

Confidence

66%

Full breach record for Delaware Life →5 incidents on file

Pension Benefit Information, LLC (PBI) disclosed a third-party data breach involving its MOVEit Transfer software provider, Progress Software. An unauthorized third party exploited a vulnerability in MOVEit to access a server on May 29-30, 2023, and downloaded data. PBI notified affected individuals on September 6, 2023, offering 24 months of identity monitoring. Data types affected include basic identity information.

J jump to incidentP pin to compareR raw source

Incident timeline

May 29, 2023

Begins

Sep 6, 2023

Filed

This filing is one of 6 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_1555027c12cc200b2023-06-15 · +82dVerified by operator

Regulatory filings (4) · sorted by filing gap

California State AGbd_944ef0f6ac2a47472023-09-06Verified by operator
California State AGbd_e3fa5bc1e3b43d372023-10-04 · +28dVerified by operator
Illinois State AGbd_396dad375fc1f4472023-01-01 · +248dVerified by operator
Illinois State AGbd_8913e1047e3bba242023-01-01 · +248dVerified by operator

Name: Pension Benefit Information, LLC
norm: pension benefit information
Domain: delawarelife.com

Name: Delaware Life
norm: delaware life
Domain: delawarelife.com
Industry: Financial ServicesllmTechnologyllm

Discovered: —
Breach occurred: May 29, 2023 – May 30, 2023
Materiality determined: —
Notification sent: Sep 6, 2023
Affected individuals: 1,141state-resident count only
Data types: Identity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Third party: via Progress Software (MOVEit Transfer)
Initial access: exploit_public_facing

During the incident: Patch servers
Investigate
Assess the security of our systems
Notify potentially affected customers and individuals
Reviewing and enhancing our information security policies and procedures
Offering you access to twenty-four (24) months of complimentary Identity Monitoring services through Kroll
Changes made: Reviewing and enhancing our information security policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+248d

Delaware State AG+248d · this page

California State AG+276d

Pattern: first filing Jan 1 (IL), last Oct 4 (CA) — a 276-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/09/Delaware-Life-Insurance-Company-PBI-letter-attached.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 6, 2023
Raw hash: 3b3b98b4d50cf06cd6a57e492c55ca790f5cbe363f7ad24fe4c29641d8d0d459

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityPension Benefit Information, LLC

Victim entityDelaware Life

IncidentThird-Party / Supply Chain

Stated responsePatch servers

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov