01—Abstract
Summary
Summary of the 8-K/A filed February 21, 2024. Cited figures are marked; the original filing is the authoritative source.
Prudential Financial, Inc. filed Amendment No. 1 to its Current Report on Form 8-K, amending the Original Report filed with the SEC on February 13, 2024, under Item 1.05 (Material Cybersecurity Incidents).
The company states that on February 5, 2024 it detected that, beginning February 4, 2024, a threat actor had gained unauthorized access to certain of its systems. External cybersecurity experts assisted, and the company activated its cybersecurity incident response process to investigate, contain, and remediate the incident. As of the filing date, Prudential believes the threat actor is a cybercrime group.
Its investigation found that the group accessed and exfiltrated from a platform limited data that includes some client information and personally identifiable information. The threat actor also accessed and exfiltrated Company administrative and user data from certain information technology systems and accessed a small percentage of Company user accounts associated with employees and contractors. The matter has been reported to relevant law enforcement, and regulatory authorities are being kept informed.
The company has found no evidence of malware, ransomware, data destruction or alteration, or that the threat actor currently has access to its systems, and it continues to investigate the extent and impact of the incident. Prudential states that the incident has not had a material impact on its operations and that it has not determined the incident is reasonably likely to materially impact its financial condition or results of operations. Investors should note that the investigation is ongoing, including whether additional information or systems were accessed.
02—Key points
Key Highlights
- Amendment No. 1 to the February 13, 2024 Original Report under Item 1.05 (Material Cybersecurity Incidents).
- Unauthorized access by a threat actor to certain company systems began February 4, 2024 and was detected February 5, 2024.
- The threat actor is believed to be a cybercrime group, and the matter has been reported to law enforcement with regulators being informed.
- Exfiltrated data includes limited client information and personally identifiable information from a platform, plus company administrative and user data.
- A small percentage of user accounts associated with employees and contractors were accessed.
- No evidence of malware, ransomware, data destruction or alteration, or ongoing threat actor access to systems has been found.
- The company states the incident has not had a material impact on operations and is not reasonably likely to materially impact financial condition or results of operations, though the investigation continues.
03—Questions
Frequently Asked Questions
When did the cybersecurity incident occur and when was it detected?
The filing states that a threat actor gained unauthorized access to certain systems beginning February 4, 2024, and Prudential detected the activity on February 5, 2024.
What data was accessed or exfiltrated?
The threat actor accessed and exfiltrated limited data from a platform, including some client information and personally identifiable information. It also accessed and exfiltrated company administrative and user data from certain IT systems and accessed a small percentage of user accounts associated with employees and contractors.
Has the incident materially affected Prudential's financial results or operations?
As of the filing date, the company states the incident has not had a material impact on its operations and has not determined it is reasonably likely to materially impact its financial condition or results of operations.
Is the threat actor still in the company's systems?
Based on its investigation to date, the company has not found evidence that the threat actor currently has access to its systems. The investigation of the extent and impact of the incident is ongoing.
Who has been notified about the incident?
The company reported the matter to relevant law enforcement and has been informing regulatory authorities.
04—Continue