HackingFinancial ServicesFinanceVulnerability ExploitZero-DaySupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIIDENTITY_GOVERNMENTMediumResolved
Educators Benefit Consultants
bd_f9502d20a514e2ae · schema v1 · pii pii-v1
Full breach record for Educators Benefit Consultants →Aviben (Educators Benefit Consultants LLC), a third-party benefits administrator, suffered an external hacking incident Feb 21-23, 2024 via a zero-day vulnerability in an external IT provider's software. Investigation concluded Jul 11, 2024. Exposed data: names, SSNs, dates of birth. 39,640 total affected; 4 Maine residents. Notices sent Aug 6, 2024. TransUnion credit monitoring offered.
Maine clockDiscovered Jul 11, 2024 → Filed with AG Aug 9, 202429d ✓ ME AG ≤30d29 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_50c401a3d66cd865Montana State AGfiled 2024-08-09Candidate
Source provenance
- Source URL
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/9def1020-5288-41ac-9c08-8b0db7a71ddc.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 9, 2024
- Raw hash
- bd037efc2478d7f482ab416e33ecb31c43e1b1773149f575185113580164857e
Reporting entity
- Name
- Educators Benefit Consultantsnorm: educators benefit consultants
- Domain
- aviben.com
- Industry
- Financial Services
Victim entity
- Name
- Educators Benefit Consultantsnorm: educators benefit consultants
- Domain
- aviben.com
- Industry
- Financial Services
- Industry
- Financial Servicesllm
Incident
- Discovered
- Jul 11, 2024
- Materiality determined
- Jul 11, 2024
- Notification sent
- Aug 6, 2024
- Affected individuals
- 4
- Data types
- PIIIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 29 days(29 days from discovery to filing)
- Compliance flags
- ME AG ≤30d · 29d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status Maine Discovered: Jul 11, 2024→ Filed with AG: Aug 9, 202429d 30 days ME AG ≤30d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.