PAN-AMERICAN LIFE INSURANCE GROUP, INC.

Pan-American Life Insurance Group, a finance sector entity reported a unauthorized access incident to the Washington Attorney General. The organization became aware of the incident on 2023-06-01 and filed notice on 2023-12-04. 616 Washington residents were affected. 186 days elapsed between awareness and notification.

Affected (this filing): 616

Pan-American Life Insurance Group, Inc. reported to HHS on 2023-12-04 a Hacking/IT Incident affecting 94,807 individuals. Breached information located on Network Server. A software application used by a business associate exposed PHI including names, DOB, SSN, diagnoses, and financial data. CE and BA provided credit monitoring and implemented safeguards.

Affected (this filing): 94,807

Pan-American Life Insurance Company (PALIC) notified California residents of a data breach involving the MOVEit Transfer application by Progress Software. An unauthorized third party exploited a previously unknown vulnerability in MOVEit to exfiltrate files containing personal information, including names, addresses, SSNs, dates of birth, driver's license numbers, medical information, biometric data, and financial account details. The breach occurred on May 28, 2023. PALIC stopped using MOVEit, secured other systems, engaged cybersecurity experts, and notified law enforcement. Affected individuals are offered 24 months of Experian IdentityWorks.

Pan-American Life Insurance Group, Inc. reported to HHS on 2023-12-04 a Hacking/IT Incident affecting 105,387 individuals. Breached information located on Network Server. A software application used by a business associate exposed PHI including names, DOB, addresses, SSN, driver's license, diagnoses, lab results, medications, and financial/claims data. The entity and BA provided complimentary credit monitoring and implemented additional safeguards.

Affected (this filing): 105,387

Pan-American Life Insurance Group, Inc. reported an external system breach (hacking) occurring on May 28, 2023, discovered on June 1, 2023. The incident affected 105,387 individuals, including 370 Maine residents. Compromised data included names and financial account or credit/debit card numbers. The company provided written notification and offered two years of credit monitoring and identity theft restoration services through Experian.

Affected (this filing): 105,387