DisclosureLens
HackingFinancial ServicesHealthcareFinanceVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Government IDHealth (basic)Financial accountBiometricHighContained

PAN-AMERICAN LIFE INSURANCE GROUP, INC.

bd_e8cbfb28e5c4ecb0 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Dec 4, 2023

To disclose

—

Affected

1,981state residents only

Linked

12 filings

Confidence

67%
Full breach record for PAN-AMERICAN LIFE INSURANCE GROUP, INC. →5 incidents on file

Pan-American Life Insurance Company (PALIC) notified Montana residents of a data security incident involving the MOVEit Transfer application. An unauthorized third party exploited a previously unknown vulnerability in MOVEit to exfiltrate files containing personal information, including names, SSNs, driver's license numbers, medical/benefits info, biometric data, and financial account details. PALIC secured systems, engaged forensic experts, notified law enforcement, and is offering 24 months of Experian IdentityWorks. No evidence of fraudulent use was found at the time of notification.

Incident timeline — partial

? — ?

Breach window unknown

Dec 4, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Regulatory filings (9) · sorted by filing gap

Show 5 more filings ↓up to 337d gap

Showing first 10 of 11 linked disclosures.

Filing propagation · 10 filings · 9 states

View merged incident ↗
Illinois State AGJan 1 · first
Washington State AG+337d
HHS OCR+337d
California State AG+337d
HHS OCR+337d
Massachusetts State AG+337d
Oregon State AG+337d
Maine State AG+337d
Montana State AG+337d · this page
New Hampshire State AG+340d

Pattern: first filing Jan 1 (IL), last Dec 7 (NH) — a 340-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.