F500 Insurance Remainder · Diversified Financials · Structural / no discrete incident
Corebridge Financial
Headline
Corebridge was caught in the MOVEit vulnerability - the 2023 file-transfer flaw that produced breaches across dozens of unrelated organisations documented throughout this tracker.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Corebridge was caught in the MOVEit vulnerability - the 2023 file-transfer flaw that produced breaches across dozens of unrelated organisations documented throughout this tracker. Corebridge was also spun out of AIG, so retirement and annuity customers found their accounts moved to a newly separated company; the corporate reorganisation was invisible to them and the data moved with the business.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED BREACH via the SAME MOVEit vulnerability documented for Hartford Insurance, AutoZone, TIAA, and Delta Dental throughout this tracker: Corebridge (one of the largest US insurance/retirement-plan providers, spun off from AIG in 2022) disclosed in an 8-K filed June 26 2023 that on June 16 2023 a third-party vendor told it Corebridge customer data - in some instances including Social Security numbers and policy numbers - had been taken through a zero-day in the vendor's MOVEit Transfer instance, affecting 'a significant number' of customers; Corebridge's own MOVEit environment was not affected. The vendor's identity (reported as PBI), an affected count of about 798,000 and a reported Texas federal class action were NOT verified this pass.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy corebridgefinancial.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service corebridgefinancial.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.