MalwareFinancial ServicesFinanceRansomwareData EncryptedSupply Chain (3P Vendor)Identity (basic)Government IDMediumContained

Newport Group, Inc.

bd_fa687827ad46b0a5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 2, 2023

Filed

Feb 16, 2024

To disclose

15 weeks

Affected

103state residents only

Linked

16 filings

Confidence

66%

Newport Group, Inc. (plan recordkeeper) notified participants of a ransomware event at third-party provider Infosys McCamish Systems (IMS) on Nov 2, 2023. IMS systems were isolated, rebuilt, and hardened by Unit 42. EY is investigating data impact. Participants' PII (name, address, DOB, SSN) was provided to IMS. No evidence of impact found yet. IdentityWorks offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 15 weeks / 106 days

Nov 2, 2023

Begins

Nov 2, 2023

Discovered

Feb 16, 2024

Filed

vs. sector median

+5 wks slower

This filing is one of 16 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Indiana State AGbd_2f40c7ba9b1e8a512024-02-16Verified
Massachusetts State AGbd_33933653706e0f642024-02-16Verified
Maine State AGbd_569adbdb9e453b182024-02-16Verified
Montana State AGbd_34f99a0a1b7ccc3f2024-02-07 · +9dCandidate

Show 6 more filings ↓up to 21d gap

Montana State AGbd_3c2a297f228ab4702024-02-29 · +13dVerified
Maine State AGbd_604c26d3099e3fe92024-02-29 · +13dVerified
Massachusetts State AGbd_bfc4408712b72fa62024-02-29 · +13dVerified
Oregon State AGbd_f32704b1d1b017c12024-02-29 · +13dVerified
Indiana State AGbd_7f405322cd8b7cd62024-03-01 · +14dVerified
New Hampshire State AGbd_c86992b6fc6b6a8c2024-03-08 · +21dVerified

Showing first 10 of 15 linked disclosures.

Name: The Northwestern Mutual Life Insurance Company
norm: the northwestern mutual life insurance
Domain: northwesternmutual.com

Name: Newport Group, Inc.
norm: newport group
Domain: northwesternmutual.com
Industry: Financial Servicesllm

Discovered: Nov 2, 2023
Breach occurred: Nov 2, 2023
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 8, 2023
Affected individuals: 103state-resident count only
Data types: Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Third party: via Infosys McCamish Systems

During the incident: Disconnected and isolate the impacted IMS systems
Engaged a leading third-party security expert, Unit 42, part of Palo Alto Networks, to validate the scope of the incident and handle remediation
Successfully restored and rebuilt its environment
Hardened the IMS environment
Engaged a leading e-discovery firm, EY, to determine whether data of any of the plans or participants that we service was impacted
Offering you a complimentary one-year identity protection package through Experian, called IdentityWorks
Changes made: Restored and rebuilt its environment
Hardened the IMS environment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Montana State AGFeb 7 · first

Indiana State AG+9d

Massachusetts State AG+9d

Maine State AG+9d

Montana State AG+9d · this page

Montana State AG+22d

Maine State AG+22d

Massachusetts State AG+22d

Oregon State AG+22d

Indiana State AG+23d

New Hampshire State AG+30d

Pattern: first filing Feb 7 (MT), last Mar 8 (NH) — a 30-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 15 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1108.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 16, 2024
Raw hash: 29b43768e50f1c9c3b423789c7400054f03b7684e06499d9623bffdd4e36f1ec

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityThe Northwestern Mutual Life Insurance Company

Victim entityNewport Group, Inc.

Incidentdiscovered Nov 2, 2023

Stated responseDisconnected and isolate the impacted IMS systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov