HackingOtherStolen CredentialsCustomer Data InvolvedTargetedIdentity (basic)Government IDPHIHealth (basic)CriticalContained

SEIU 775 Benefits Group

bd_eaff1152ee70bba3 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Apr 4, 2021

Filed

May 5, 2021

To disclose

4 weeks

Affected

124,760state residents only

Linked

8 filings

Confidence

69%

Full breach record for SEIU 775 Benefits Group →2 incidents on file

SEIU 775 Benefits Group notified Washington AG of unauthorized access to systems on April 4, 2021. Unknown individuals gained access, deleted PII (SSNs) and PHI. No evidence of exfiltration. 124,760 Washington residents affected. Notices sent May 10, 2021. Identity monitoring provided via Kroll.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d4 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 4 weeks / 31 days

Apr 4, 2021

Begins

Apr 4, 2021

Discovered

May 5, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Maine State AGbd_4eed9e5d08f4316e2021-05-05Candidate
Montana State AGbd_b60810c0e7a094f82021-05-05Verified
New Hampshire State AGbd_c6bce138de23e32b2021-05-05Verified
California State AGbd_35977db1483cf3b62021-05-07 · +2dVerified

Show 3 more filings ↓up to 5d gap

Indiana State AGbd_2e0149077c836f682021-05-10 · +5dVerified
Massachusetts State AGbd_436e357d5e8054122021-05-10 · +5dVerified
Oregon State AGbd_8267684fde29ea0c2021-05-10 · +5dVerified

Name: SEIU 775 Benefits Group
norm: seiu 775 benefits

Name: SEIU 775 Benefits Group
norm: seiu 775 benefits
Industry: Otherllm

Discovered: Apr 4, 2021
Breach occurred: Apr 4, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 10, 2021
Affected individuals: 124,760state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: NameSocial Security number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1070 Indicator Removal
Threat actor: External
Regulator citations: Notified federal law enforcement authorities
Initial access: valid_credentials

During the incident: Worked diligently with third party cybersecurity and forensic consultants to contain the incident and secure the impacted systems
Implementing measures on the compromised account to prevent logins by the threat actor and other unauthorized individuals
Working on an ongoing basis with cybersecurity consultants to further fortify SEIU 775 Benefits Group systems
Notified federal law enforcement authorities and other stakeholders
Retained leading third-party cybersecurity and forensic consultants to investigate the nature and scope of the incident
Engaged legal counsel
Changes made: Secured the services of Kroll to provide identity monitoring at no cost to you for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(31 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 8 states

View merged incident ↗

Maine State AGMay 5 · first

Montana State AGMay 5 · first

New Hampshire State AGMay 5 · first

Washington State AGMay 5 · first · this page

California State AG+2d

Indiana State AG+5d

Massachusetts State AG+5d

Oregon State AG+5d

Pattern: first filing May 5 (ME), last May 10 (OR) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10460.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 5, 2021
Raw hash: 95d4d56ab4ba77cebd764cf572f8446628610418e3fbcc3ac8dd90a736fb14fb

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entitySEIU 775 Benefits Group

Victim entitySEIU 775 Benefits Group

Incidentdiscovered Apr 4, 2021

Stated responseWorked diligently with third party cybersecurity and forensic consultants to contain the incident and secure the impacted systems

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com