HackingVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIDENTITY_BASICLowContained
United Association National Pension Fund
bd_e7b97bfb552d0599 · schema v1 · pii pii-v1
Full breach record for United Association National Pension Fund →Pension Benefit Information, LLC (PBI) disclosed a data breach resulting from a vulnerability in Progress Software's MOVEit Transfer product. An unauthorized third party exploited this vulnerability to access PBI's MOVEit server on May 29-30, 2023, and downloaded data. PBI discovered the incident on May 31, 2023, when Progress disclosed the vulnerability. The affected data includes names and other basic identity information. PBI has patched servers, investigated the scope, and is offering 12 months of credit monitoring via Kroll.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_a15ffe4add5704eaMaine State AGfiled 2023-09-15Candidate
- bd_ec3d3ca681105269Montana State AGfiled 2023-09-15Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-573364
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 15, 2023
- Raw hash
- 644843c7311030032a306db3374f6d486e7e61120eefa08c72ecfff811126fd2
Reporting entity
- Name
- United Association National Pension Fundnorm: united association national pension
Victim entity
- Name
- United Association National Pension Fundnorm: united association national pension
Incident
- Discovered
- May 31, 2023
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASIC
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 15 weeks(107 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.