MalwareFinancial ServicesFinancePhishingRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedFinancial accountHealth (basic)Identity (basic)Government IDPHIMediumContained

PAN-AMERICAN LIFE INSURANCE GROUP, INC.

bd_ffc6147672576b84 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 19, 2021

Filed

Mar 11, 2021

To disclose

20 days

Affected

599state residents only

Linked

11 filings

Confidence

68%

Full breach record for PAN-AMERICAN LIFE INSURANCE GROUP, INC. →5 incidents on file

Pan-American Life Insurance Group (PALIG) filed a supplemental notice with the Washington AG regarding a phishing-induced malware incident. Suspicious activity was detected on Feb 19, 2021. The attack resulted in the exfiltration of names, addresses, DOBs, and sensitive data (SSN, driver's license, financial accounts, medical info) for 599 individuals. PALIG took systems offline, engaged forensic experts, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d20 days discovery → filing

Incident timeline

discovery → filing · 20 days

Feb 19, 2021

Discovered

Mar 9, 2021

Scope determined

Mar 11, 2021

Filed

vs. sector median

6 wks faster

This filing is one of 11 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_210f3813699a65032021-03-11Verified
California State AGbd_4c420d6a8894a3ff2021-03-11Verified
Maine State AGbd_6ad9d6e594b013d22021-03-11Candidate
Oregon State AGbd_998b87a09ea02dbb2021-03-11Verified

Show 6 more filings ↓up to 61d gap

Indiana State AGbd_b9faa419326142022021-03-11Verified
New Hampshire State AGbd_1b6f9b2256849ef72021-03-15 · +4dVerified
South Carolina State AGbd_3ae349d38c3488b52021-03-16 · +5dVerified
Maine State AGbd_20a55628c87f9f642021-04-07 · +27dVerified
Maine State AGbd_fd5d731d6a5e6baf2021-04-30 · +50dVerified
New Hampshire State AGbd_4c2efe11d52f8f372021-05-11 · +61dVerified

Name: PAN-AMERICAN LIFE INSURANCE GROUP, INC.
norm: pan american life insurance
Domain: palig.com
Industry: Finance

Name: PAN-AMERICAN LIFE INSURANCE GROUP, INC.
norm: pan american life insurance
Domain: palig.com
Industry: Finance
Industry: Financial Servicesllm

Discovered: Feb 19, 2021
Materiality determined: Mar 9, 2021
Notification sent: Mar 11, 2021
Affected individuals: 599state-resident count only
Data types: Financial accountHealth (basic)Identity (basic)Government IDPHI
Data elements: NameSocial Security numberDriver's licence numberFinancial account numberDate of birthPassport numberMedical information
WA-stated cause: Cyberattack
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: phishing_link

During the incident: Took computer network offline
Engaged third-party cyber experts to partner with its team to launch an investigation
Established a dedicated call center to provide information
Offered a complimentary one-year subscription to Experian IdentityWorks Credit Monitoring and Identity Theft Protection
Changes made: Taking steps to further protect and strengthen the security of its systems
Enhanced security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 20 days(20 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 8 states

View merged incident ↗

Massachusetts State AGMar 11 · first

California State AGMar 11 · first

Maine State AGMar 11 · first

Oregon State AGMar 11 · first

Indiana State AGMar 11 · first

Washington State AGMar 11 · first · this page

New Hampshire State AG+4d

South Carolina State AG+5d

Maine State AG+27d

Maine State AG+50d

New Hampshire State AG+61d

Pattern: first filing Mar 11 (MA), last May 11 (NH) — a 61-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10421.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 11, 2021
Raw hash: 8d94426a79939ea46cf1c8e85d80d091a90e6c69480a7626b740758d22ee253f

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityPAN-AMERICAN LIFE INSURANCE GROUP, INC.

Victim entityPAN-AMERICAN LIFE INSURANCE GROUP, INC.

Incidentdiscovered Feb 19, 2021

Stated responseTook computer network offline

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com