HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedPIIIdentity (basic)LowActive

Empire Fidelity Investments Life Insurance Company

bd_edd3fb4b6e68d599 · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 1, 2023

Filed

Mar 22, 2024

To disclose

20 weeks

Affected

464state residents only

Linked

5 filings

Confidence

66%

Full breach record for Empire Fidelity Investments Life Insurance Company →2 incidents on file

Fidelity Investments Life Insurance Company issued a supplemental notice to the New Hampshire AG regarding a cybersecurity event at third-party vendor Infosys McCamish Systems (IMS). Unauthorized access occurred between Oct 29 and Nov 2, 2023, likely involving stolen credentials and data exfiltration. 464 NH residents were impacted. Notices began mailing March 15, 2024, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 3 days

discovery → filing · 20 weeks / 142 days

Oct 29, 2023

Begins

Nov 1, 2023

Discovered

Mar 22, 2024

Filed

vs. sector median

+12 wks slower

This filing is one of 5 filings about the same incident.View merged incident

Part of INFOSYS MCCAMISH SYSTEMS, LLC supply-chain incident (2024) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

California State AGbd_1ac32f968bc770ad2024-03-18 · +4dVerified by operator
Maine State AGbd_6a230510306768c32024-03-18 · +4dVerified by operator
Maine State AGbd_0599d8427643f9fe2024-03-04 · +18dCandidate
California State AGbd_1b81b0d92a8605332024-03-01 · +21dVerified

Name: Empire Fidelity Investments Life Insurance Company
norm: empire fidelity investments life insurance
Domain: fidelity.com

Name: Empire Fidelity Investments Life Insurance Company
norm: empire fidelity investments life insurance
Domain: fidelity.com
Industry: Financial Servicesllm

Discovered: Nov 1, 2023
Breach occurred: Oct 29, 2023 – Nov 2, 2023
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 15, 2024
Affected individuals: 464state-resident count only
Data types: PIIIdentity (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Filed supplemental notice with New Hampshire Office of the Attorney General Consumer Protection Bureau
Third party: via Infosys McCamish Systemsvendor
Initial access: valid_credentials

During the incident: Engaged with IMS to understand the nature and scope of the incident
Conducted a manual review of our records to identify the individuals potentially affected
Remained engaged with IMS as they continue their investigation
Arranged for credit monitoring and identity restoration services at no cost
Changes made: Offered complimentary credit monitoring and identity theft restoration services through TransUnion
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 weeks(142 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 3 states

View merged incident ↗

California State AGMar 1 · first

Maine State AG+3d

California State AG+17d

Maine State AG+17d

New Hampshire State AG+21d · this page

Pattern: first filing Mar 1 (CA), last Mar 22 (NH) — a 21-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/fidelity-investments-life-insurance-co-empire-fidelity-life-insurance-co-20240322.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 22, 2024
Raw hash: 5a83cb36ab057bc788c0af08c42cba4c2f84f816c50b712ed407f0c7059fdb03

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityEmpire Fidelity Investments Life Insurance Company

Victim entityEmpire Fidelity Investments Life Insurance Company

Incidentdiscovered Nov 1, 2023

Stated responseEngaged with IMS to understand the nature and scope of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov