HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
Delaware Life
bd_e3fa5bc1e3b43d37 · schema v1 · pii pii-v1
Full breach record for Delaware Life →Delaware Life Insurance Company notified the California AG of a data breach affecting its customers. The incident resulted from a vulnerability in Progress Software's MOVEit Transfer tool, exploited by an unauthorized third party on May 29-30, 2023. PBI, a service provider for Delaware Life, confirmed data was downloaded. Affected data includes names and other basic identity information. The company patched servers, investigated the scope, and is offering 24 months of identity monitoring via Kroll.
California clockDiscovered May 31, 2023 → Notified Sep 6, 202398d ✗ CA 60-day late18 weeks discovery → filing
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-574651
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Oct 4, 2023
- Raw hash
- 7934f0256de92091d1b2416b69d3d244fa4ea9d1273f57110107989ba488c8c5
Reporting entity
- Name
- Pension Benefit Information, LLCnorm: pension benefit information
- Domain
- mypensionbenefitinformation.com
Victim entity
- Name
- Delaware Lifenorm: delaware life
- Domain
- delawarelife.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- Sep 6, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 18 weeks(126 days from discovery to filing)
- Compliance flags
- CA 60-day late · 98d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: May 31, 2023→ Notified: Sep 6, 202398d 60 days (analyst band, pre-2026 discoveries) CA 60-day late
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.