HackingStolen CredentialsScattered SpiderMulti-Stage ChainCustomer Data InvolvedEmployee Data InvolvedPIIIDENTITY_BASICMINORMediumContained
Bankers Life and Casualty Company
bd_f5b10da171539b6b · schema v1 · pii pii-v1
Full breach record for Bankers Life and Casualty Company →Bankers Life and Casualty Company reported a data breach affecting 63 New Hampshire residents. On November 29, 2023, the threat actor 'Scattered Spider' conducted a SIM-swapping attack targeting a senior officer's cellular account, bypassing MFA to access company data. The incident was contained, and affected individuals were notified on January 26, 2024, with credit monitoring offered.
This filing is one of 7 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- bd_489763d38fcd7db5Montana State AGfiled 2024-01-30Verified
- bd_7279c81e38952fbaWashington State AGfiled 2024-01-30Verified
- bd_ceb4c165523f0761Maine State AGfiled 2024-01-30Verified
- bd_3db61e65232ceb3bCalifornia State AGfiled 2024-01-29(1d gap)Candidate
Show 2 more filings ↓Show fewer ↑up to 4d gap
- bd_6ad88753f461a26fOregon State AGfiled 2024-01-29(1d gap)Verified
- bd_e963eb59f735e937Indiana State AGfiled 2024-01-26(4d gap)Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/bankers-life-casualty-20240130.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jan 30, 2024
- Raw hash
- 5ca532affc21689d2f936f4d36c7a44e2eeec2804b360c008dba2bcf81bd995e
Reporting entity
- Name
- Bankers Life and Casualty Companynorm: bankers life and casualty
Victim entity
- Name
- Bankers Life and Casualty Companynorm: bankers life and casualty
Incident
- Discovered
- Nov 29, 2023
- Materiality determined
- Jan 16, 2024
- Notification sent
- Jan 26, 2024
- Affected individuals
- 63
- Data types
- PIIIDENTITY_BASICMINOR
- Attack vector
- Unauthorized Access· Scattered Spider
- MITRE ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1078.004 Cloud Accounts
- Threat actor
- Scattered SpiderExternalFinancial
- Regulator citations
- Notified Federal Bureau of InvestigationWorking with Offices of the United States Attorneys
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 9 weeks(62 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.