HackingFinancial ServicesFinanceVulnerability ExploitCLOPSupply Chain (3P Vendor)Data ExfiltratedTargetedIdentity (basic)Government IDCVE-2023-34362HighActive

TALCOTT RESOLUTION LIFE INSURANCE COMPANY

bd_f44ab3950a8ac51d · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 4, 2023

Filed

Jul 27, 2023

To disclose

8 weeks

Affected

11,675state residents only

Confidence

69%

Full breach record for TALCOTT RESOLUTION LIFE INSURANCE COMPANY →4 incidents on file

Talcott Resolution Life Insurance Company notified the South Carolina Attorney General on June 26, 2023, of a data security event involving its vendor, PBI Research Services. Attackers believed to be the CLOP group exploited the MOVEit vulnerability (CVE-2023-34362) to exfiltrate data. Approximately 11,675 South Carolina residents were affected. Data likely included names, dates of birth, Social Security Numbers, and policy numbers. Talcott is offering credit monitoring and identity theft protection.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 8 weeks / 53 days

Jun 4, 2023

Discovered

Jul 27, 2023

Filed

vs. sector median

2 wks faster

Part of Pension Benefit Information, LLC supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed11,675 affectedView incident

Name: TALCOTT RESOLUTION LIFE INSURANCE COMPANY
norm: talcott resolution life insurance
Domain: talcottresolution.com

Name: TALCOTT RESOLUTION LIFE INSURANCE COMPANY
norm: talcott resolution life insurance
Domain: talcottresolution.com
Industry: Financial Servicesllm

Discovered: Jun 4, 2023
Materiality determined: —
Notification sent: —
Affected individuals: 11,675state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Third-Party / Supply Chain· CLOP
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: CLOPExternalFinancial
Regulator citations: Notified primary insurance regulators beginning June 8Continue to notify and update other regulators
Third party: via PBI Research Services
Initial access: exploit_public_facing
CVE references: CVE-2023-34362

During the incident: Notified primary insurance regulators beginning June 8
Continue to notify and update other regulators
Engaged a third party to perform a review and assessment of PBI’s cybersecurity risk and controls
Offering free credit monitoring and identity theft protection
Changes made: Require cybersecurity controls including maintaining information security safeguards
Complete an annual SOC 2, Type II audit and quarterly network vulnerability scan
Maintain documented information security policies, including a business continuity plan
Encrypt production data maintained to provide its services both in transit and at rest
Maintain data in the United States
Restrict access to use of data to certain individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Security%20Breach%20Notices/TalcottResolutionLifeInsuranceCompany.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 27, 2023
Raw hash: 2e4d9d7fb255d424284fab46b1990a8d03e4aa5e8e679957bcf8f6340d1443c4

Reporting entityTALCOTT RESOLUTION LIFE INSURANCE COMPANY

Victim entityTALCOTT RESOLUTION LIFE INSURANCE COMPANY

Incidentdiscovered Jun 4, 2023

Stated responseNotified primary insurance regulators beginning June 8

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov