PBI data breach impacted over 44,000 Loyal American insurance customers

Loyal American Life Insurance Company, one of the prominent life insurance companies in the United States, said it suffered a major data breach that affected the personal information of more than 40,000 individuals.

In a recent regulatory filing with the Office of the Maine Attorney General, the insurance provider said that one of its vendors, Pension Benefit Information, suffered a massive cyber security incident as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.

PBI provides regulatory compliance and operational support services to insurance companies, pension funds, and other organisations, including the Loyal American Life Insurance Company.

PBI used Progress Software’s MOVEit file transfer application to send and receive data from some of its clients and was affected by malicious exploitation of a zero-day vulnerability in the file transfer software.

Soon after PBI became aware of the security incident, it launched an internal investigation to understand the nature and scope of the security incident.

“Through our investigation, we learned that the third party accessed one of our MOVEit Transfer servers on May 29, 2023 and May 30, 2023 and downloaded data. We then conducted a manual review of our records to confirm the identities of individuals potentially affected by this event and their contact information to provide notifications. We recently completed this review and shared the findings with our impacted customers,” the company said.

The compromised information included the full names of Loyal American Life Insurance Company’s customers along with their Social security Numbers and other personal identifier data. The filing with the Maine Attorney General’s office also confirms that at least 44,400 individuals have been affected by the data breach.

PBI says it is providing two years of complimentary credit monitoring, fraud consultation and identity restoration services through Kroll to all affected individuals and has set up a hotline where impacted clients can call and get their queries answered.

The PBI data breach also impacted the personal information of more than 35,000 individuals who obtained insurance services from the New York Life Insurance Company, one of the largest life insurance companies in the United States. PBI said in August that the data breach also impacted more than 1.2 million customers of Connecticut-based Wilton Reassurance Life Company.