HackingFinancial ServicesFinanceStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDMediumContained

METROPOLITAN LIFE INSURANCE CO

bd_faf3aa9b40c53bb7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 22, 2024

Filed

Aug 28, 2024

To disclose

27 weeks

Affected

1state residents only

Linked

6 filings

Confidence

65%

Full breach record for METROPOLITAN LIFE INSURANCE CO →46 incidents on file

Metropolitan Life Insurance Company notified Montana residents of a data breach involving a third-party service provider's network. Unauthorized access was detected on February 22, 2024, potentially exposing names, DOBs, policy numbers, and SSNs of retirement plan customers. MetLife provided one year of free credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 weeks / 188 days

Feb 22, 2024

Discovered

Aug 28, 2024

Filed

vs. sector median

+18 wks slower

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Massachusetts State AGbd_0628c89b51b321c22024-08-29 · +1dVerified
Texas State AGbd_9fb330886330758f2024-08-29 · +1dVerified
Indiana State AGbd_7bbd29fab54c45072024-08-27 · +1dVerified
Delaware State AGbd_b8dbb0cdd9b101a72024-08-27 · +1dVerified

Show 1 more filing ↓up to 2d gap

Maine State AGbd_60c1157313c165fe2024-08-26 · +2dCandidate

Name: METROPOLITAN LIFE INSURANCE CO
norm: metropolitan life insurance
Domain: metlife.com

Name: METROPOLITAN LIFE INSURANCE CO
norm: metropolitan life insurance
Domain: metlife.com
Industry: Financial Servicesllm

Discovered: Feb 22, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1078 Valid Accounts
Threat actor: External
Initial access: supply_chain

During the incident: Arranged for you to enroll, at no cost to you, in an online three-bureau credit monitoring service (myTrueIdentity) for one year
Arranged for enrollment in a similar offline paper-based credit monitoring service via U.S. mail delivery
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(188 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Maine State AGAug 26 · first

Indiana State AG+1d

Delaware State AG+1d

Montana State AG+2d · this page

Massachusetts State AG+3d

Texas State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-notification-letter-1635.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 28, 2024
Raw hash: e3335586cc3e153c1c91e413ce4709f5e8e588bb08103db167225688ab8f4cc6

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMETROPOLITAN LIFE INSURANCE CO

Victim entityMETROPOLITAN LIFE INSURANCE CO

Incidentdiscovered Feb 22, 2024

Stated responseArranged for you to enroll, at no cost to you, in an online three-bureau credit monitoring service (myTrueIdentity) for one year

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov