Corebridge Financial, Inc. — Form 8-K Summary
Business Context and Reporting Period
Corebridge Financial, Inc. filed a Form 8-K dated June 26, 2023, under Item 8.01 (Other Events). The filing concerns a cybersecurity incident involving a third-party vendor and the MOVEit Transfer application. It is not a periodic financial results filing.
Financial Metrics and Liquidity
The filing does not provide revenue, profit, cash flow, margin, debt, liquidity, or other financial performance metrics. Corebridge reported no material interruption to business operations and stated that it does not currently believe the incident will have a material adverse effect on its business, operations, or financial results.
Material Changes and Unusual Items
- On June 16, 2023, a vendor notified Corebridge that customer data had been compromised in a security incident targeting a zero-day vulnerability in the vendor’s instance of MOVEit.
- The compromised information was in the vendor’s possession and involved a significant number of Corebridge customers; information included, in some instances, Social Security numbers and policy numbers.
- Corebridge’s own information systems and MOVEit environment were not affected, according to the filing.
- The company and vendor initiated an investigation, which remained ongoing as of the filing date.
Management Commentary, Risks, and Contingencies
Corebridge stated that it will provide required notifications to affected individuals and regulatory agencies. Impacted individuals will be offered complimentary credit monitoring and identity restoration services. The company is continuing to assess remediation expenses and other potential liabilities, but the filing does not provide an estimated cost or quantified financial exposure.
Key Facts for Investors to Verify
- The final scope and nature of affected customer information and the number of impacted individuals.
- Whether the ongoing investigation identifies additional systems, data, or customers affected.
- Actual remediation expenses, regulatory actions, litigation, insurance recoveries, or other liabilities.
- Whether the company’s assessment changes from its current view that the incident will not have a material adverse effect.
- Required customer and regulatory notifications, including updates available through Corebridge’s vendor-incident website.