DisclosureLens
All incidentsView linkage analytics →Get the evidence package — $7.99what’s inside →
Leak SiteSEC 8-KState AGConfirmed11 records · 7 statesLifecycle stage 2 of 3: ConfirmedUnverified claimConfirmedEnforcedcl0phigh sensitivity
Merged incident · 11 records

JACKSON NATIONAL LIFE INSURANCE COMPANY — May 2023 breach

Clustered 11 records across 8 jurisdictions: 10 filings and 1 leak-site claim · filing window Jun 26, 2023 → Aug 17, 2023 (dated filings only). View entity profile → Other incidents for this victim →

⚠ 2 cross-filing discrepancies →Merge100%

Determination

Confirmed

Members

11 records

States

7

Affected · reported

852,644

First → last dated filing

Jun 26, 2023 → Aug 17, 2023

Merge confidence

100%

incident inc_9d3f442155504b1f · merged by human · confidence 100%

Confirmed breach. Merged as one breach: 10 regulatory filings and 1 unverified claim. The filings describe hacking. Intrusion May 29, 2023–May 30, 2023, discovered May 29, 2023. 852,644 individuals reported across the linked filings. Data reported: Government ID, PII, Financial account, and 1 more. Notifications rolled out on a 52-day schedule across 9 dated filings beginning Jun 26, 2023. Each member filing remains the legal record for its jurisdiction.

Litigation Timing

Supplemental
Discovery variance
22days

Range of discovered_at dates across filings

Filing span
52days

Time between earliest and latest filing

Not recorded for this incident

Leak precedence · Materiality delta · SEC filing delay

Regulatory clocksOregon✗ OR AG >45dSouth Carolina✓ SC CRA notice dueFull clock table in Litigation Timeline

Sensitive data

identity_government

Incident timeline

May 29, 2023breach begins
May 29, 2023discovered · members disagree
Jun 26, 2023first dated filing
Aug 17, 2023most recent dated filing

Dashed segments are unestablished, not zero — they fill in as filings merge into this incident. Filings without a recorded filing day, or recorded as filed before the breach they report began, are not placed on this rail.

Member cascade — every filing and leak-site claim in this incident

  1. JAN 1IL AGIL AG noticefiling day not on record · no count stated—
  2. JUN 26SEC 8-KSEC 8-K noticefirst filing · 700,000 affectedday 0
  3. JUN 26MA AGMA AG notice563 MA residentsday 0
  4. JUN 26MA AGMA AG notice14,622 MA residentsday 0
  5. JUN 29Leak sitecl0p postattacker claim · unverified+3d
  6. JUL 24IN AGIN AG noticestates nationwide total 852,644+28d
  7. JUL 24WA AGWA AG notice22,709 WA residents+28d
  8. JUL 25CA AGCA AG noticeno count stated+29d
  9. JUL 27SC AGSC AG notice62,929 SC residents+31d
  10. JUL 27OR AGOR AG noticestates nationwide total 845,644+31d
  11. AUG 17OR AGOR AG noticemost recent · states nationwide total 7,000+52d
  12. Watching for additional filings — new sources merge into this incident automatically.

Roll-up facts — reconciled across members

Breach window
May 29, 2023
IN AG
Discovered
May 29, 2023IL AGMay 31, 2023SC AGJun 1, 2023WA AGJun 20, 2023OR AGfilings disagree on discovery
Data types
Financial account · Identity (basic) · Government ID · PII
SEC 8-K + MA AG + WA AG +2
Attack vector
Third-Party / Supply Chain
SEC 8-K

Each fact cites the member filing that establishes it; when filings conflict, every value shows with its source.

Count reconciliation

per-state reported counts

Nationwide (stated in a filing)

852,644

Sum of filed state slices

100,763· 11.8% of stated

88% of the stated total lives in states whose filings carry no count — the dashed share shrinks as filings land.

US852,644
SC62,929
WA22,709
MA14,622
IN503

State AGs report only their own residents; teal bars show each state's reported slice. The gray US row is the nationwide total reported in a linked filing.

Evidence ladder — rungs this incident occupies

Leak-site claim1 member

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

No press coverage linked yet.

State AG / regulator filing9 members

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement1 member

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Merge provenance

Method
human
Confidence
1.00 · above the 0.85 auto-merge floor
Reviewed
operator-reviewed Aug 25, 2026 · at least one link edge was human-adjudicated
Audit
Every link edge records its method, confidence and model + prompt versions (100% is the strongest edge).

Merges are reversible — a wrong link can be detached with its audit trail intact. How merging works.

Filing velocity

Spread

52 days

Cadence

~1 / 6.5d

vs. multi-state median

8.7× slower

About this clustering

DisclosureLens links filings into incidents through layered matchers: deterministic rules (same source document, multistate filings of one breach, tight-window same-victim pairs), a weighted-similarity scorer for cross-source candidates, and an operator review queue for everything uncertain. Each link records its own method and confidence — shown per filing in the timeline below. The system defaults to NOT merging when uncertain, because a false merge (collapsing two unrelated breaches) is more harmful than a false split (showing related filings separately); uncertain pairs route to human review instead of auto-merging. This page states only what the linked filings agree on; each filing's own account stays on its own record, linked from the timeline below.

The weekly clock on records like this one

The Disclosure Clock is a weekly briefing on what landed in the disclosure record, and the gap between the criminals' post and the regulator's filing — measured on the whole record, with the method shown.

Weekly. Double opt-in, one-click unsubscribe, and the address goes nowhere else.