Pension Benefit Information
Disclosed Jul 10, 20233 years ago1,866,694 affectedConfirmed
The business associate (BA), Pension Benefit Information, reported that its third-party vendor experienced a cyber incident that affected the protected health information (PHI) of 1,866,694 individuals. The PHI involved included names, Social Security numbers, addresses, dates of birth, and health insurance and financial information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach, the CE provided complimentary credit monitoring services and implemented additional administrative, technical, and security safeguards to better protect PHI.
What is known
| People affected | 1,866,694 (as reported to HHS) |
|---|---|
| Disclosed | Jul 10, 2023 |
| Discovered | Jun 2, 2023 |
| Happened | May 29, 2023 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
Notices filed
| Where | Filed | People |
|---|---|---|
| Delaware DOJresidents of DE | Jul 10, 2023 | 1,604 |
| California AGresidents of CA | Jul 11, 2023 | |
| Washington AGresidents of WA | Jul 12, 2023 | 18,856 |
| Oregon DOJresidents of OR | Jul 12, 2023 | 371,359 |
| Vermont AGresidents of VT | Jul 12, 2023 | |
| Indiana AGresidents of IN | Jul 12, 2023 | 14,857 |
| HHS archivetotal | Jul 14, 2023 | 1,866,694 |
| Oregon DOJresidents of OR | Jul 27, 2023 | 2,373,076 |
| Oregon DOJresidents of OR | Jul 31, 2023 | 27,946 |
| Oregon DOJresidents of OR | Aug 2, 2023 | 42,922 |
| California AGresidents of CA | Aug 4, 2023 | |
| Vermont AGresidents of VT | Aug 4, 2023 | |
| Vermont AGresidents of VT | Aug 10, 2023 | |
| Indiana AGresidents of IN | Aug 10, 2023 | 170 |
| California AGresidents of CA | Aug 16, 2023 | |
| California AGresidents of CA | Aug 24, 2023 | |
| Vermont AGresidents of VT | Aug 24, 2023 |
History of this record
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · data_types: ["names"] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 371359 to 1866694 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Pension Benefit Information, reported that its third-party vendor experienced a cyber incident that affected the protected health information (PHI) of 1,866,694 individuals. The PHI involved included names, Soci · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 371359 · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-07-12-pension-benefit-information-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-08-04-pension-benefit-information-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-08-10-pension-benefit-information-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2023-08-24-pension-benefit-information-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · disclosed: 2023-07-11 to 2023-07-10 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2023-06-02 · backfill source
- 2026-09-25 · disclosed: 2023-08-04 to 2023-07-11 · backfill source
- 2026-09-25 · disclosed: 2023-08-16 to 2023-08-04 · backfill source
- 2026-09-25 · disclosed: 2023-08-24 to 2023-08-16 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.