HackingFinancial ServicesFinanceVulnerability ExploitCapture Stored DataCL0PZero-DayData ExfiltratedData PublishedSupply Chain (3P Vendor)TargetedFinancial accountHealth (basic)Identity (basic)Government IDPHIHighContained

UNUM GROUP

bd_e9863c8671e00ee8 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 1, 2023

Filed

Aug 21, 2023

To disclose

12 weeks

Affected

4,186state residents only

Linked

7 filings

Confidence

69%

Full breach record for UNUM GROUP →12 incidents on file

Unum Group notified Washington AG of a cybersecurity incident involving the MOVEit Transfer application. The incident exploited a zero-day vulnerability attributed to the CL0P ransomware gang. Unauthorized access occurred between May 15 and June 1, 2023. Data exfiltrated included names, SSNs, medical info, and policy data for 4,186 Washington residents. Unum engaged forensic experts, notified the FBI, and offered 24 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 weeks discovery → filing

Incident timeline

undetected · 17 days

discovery → filing · 12 weeks / 81 days

May 15, 2023

Begins

Jun 1, 2023

Discovered

Aug 21, 2023

Filed

vs. sector median

+3 wks slower

This filing is one of 7 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Oregon State AGbd_be1b59e27105faaa2023-09-05 · +15dVerified
Indiana State AGbd_7e4b64e3b2796a5e2023-08-03 · +18dCandidate
HHS OCRbd_daff25a5bf2dc4eb2023-08-03 · +18dCandidate
South Carolina State AGbd_5fd3c14b044d2a092023-09-19 · +29dVerified

Show 2 more filings ↓up to 29d gap

California State AGbd_60e06d7b099885312023-09-19 · +29dVerified
Massachusetts State AGbd_d63872c90f649d742023-09-19 · +29dVerified

Name: UNUM GROUP
norm: unum group
Domain: plane.biz

Name: UNUM GROUP
norm: unum group
Domain: plane.biz
Industry: Financial Servicesllm

Discovered: Jun 1, 2023
Breach occurred: May 15, 2023 – Jun 1, 2023
Undetected for: 17 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2023
Affected individuals: 4,186state-resident count only
Data types: Identity (basic)Government IDHealth (basic)Financial account
Data elements: NameSocial Security numberFinancial account numberDate of birthHealth insurance IDMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Third-Party / Supply Chain· CL0P
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: CL0PExternalFinancial
Regulator citations: Notified the FBIProviding substantially similar notice of this incident to government agencies (including attorneys general and insurance regulators) in other states
Initial access: exploit_public_facing

During the incident: Taking the MOVEit Transfer application offline
Implementing vendor-recommended actions including application of patches as Progress made them available
Initiating an investigation with the assistance of third-party cybersecurity experts
Notifying law enforcement
Monitoring publicly available information regarding this vulnerability
Engaging a leading e-discovery firm to help analyze the data identified in the investigation as potentially exfiltrated
Changes made: Further enhancing its security controls to protect from cyber threats
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(81 days from discovery to filing)
Compliance flags: Leak >180dWA AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

Indiana State AGAug 3 · first

HHS OCRAug 3 · first

Washington State AG+18d · this page

Oregon State AG+33d

South Carolina State AG+47d

California State AG+47d

Massachusetts State AG+47d

Pattern: first filing Aug 3 (IN), last Sep 19 (MA) — a 47-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA26267.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 21, 2023
Raw hash: b38fdd23093be3af1eca508ca090475c52ac1f3c31a0e74a8c2742c1071bd527

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityUNUM GROUP

Victim entityUNUM GROUP

Incidentdiscovered Jun 1, 2023

Stated responseTaking the MOVEit Transfer application offline

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com