Social EngineeringFinancial ServicesFinancePhishingStolen CredentialsTargetedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Colorado Bankers Life Insurance Company

bd_fdd0d8253bd2d88f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 14, 2018

Filed

Aug 3, 2018

To disclose

7 weeks

Affected

956state residents only

Linked

6 filings

Confidence

71%

Full breach record for Colorado Bankers Life Insurance Company →

Colorado Bankers Life Insurance Company reported a targeted phishing attack in Washington that compromised 6 cloud-based employee email accounts between March 28 and April 13, 2018. The incident exposed names, SSNs, payment card numbers, and financial account numbers of 956 Washington residents. CBLife secured accounts, engaged forensic investigators, notified law enforcement, and implemented MFA and employee training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 78 days

discovery → filing · 7 weeks / 50 days

Mar 28, 2018

Begins

Jun 14, 2018

Discovered

Aug 3, 2018

Filed

vs. sector median

2 wks faster

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

Montana State AGbd_53dd610374a4b9452018-08-03Candidate
Oregon State AGbd_c11f550792ce560b2018-08-03Verified
California State AGbd_d289c3d80b9d481f2018-08-03Verified
Massachusetts State AGbd_d2c2fb2ad32f75322018-08-03Verified

Show 1 more filing ↓

New Hampshire State AGbd_e6799827f16ae8902018-08-03Verified

Name: Colorado Bankers Life Insurance Company
norm: colorado bankers life insurance

Name: Colorado Bankers Life Insurance Company
norm: colorado bankers life insurance
Industry: Financial Servicesllm

Discovered: Jun 14, 2018
Breach occurred: Mar 28, 2018 – Apr 13, 2018
Undetected for: 78 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2018
Affected individuals: 956state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: NameSocial Security numberFinancial account number
WA-stated cause: Cyberattack
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified law enforcement
Initial access: phishing_link

During the incident: Secured the potentially affected employee email accounts
Changed account settings to enhance security
Engaged a leading cyber security firm to assist with the investigation
Undertook a comprehensive review of the emails in the employees' email accounts
Notified law enforcement
Changes made: Provided additional extensive training to its employees regarding phishing emails and other cybersecurity issues
Enhanced existing security measures by implementing multi-factor authentication for email
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 6 states

View merged incident ↗

Montana State AGAug 3 · first

Oregon State AGAug 3 · first

California State AGAug 3 · first

Massachusetts State AGAug 3 · first

New Hampshire State AGAug 3 · first

Washington State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10576.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2018
Raw hash: c904b6a0cf13a8ff2e45229d79eac0407675464513b04f8ba1b8fdb58b87f964

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityColorado Bankers Life Insurance Company

Victim entityColorado Bankers Life Insurance Company

Incidentdiscovered Jun 14, 2018

Stated responseSecured the potentially affected employee email accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com