Sun Life Financial says MOVEit data breach impacted more than 212k US customers

Sun Life Financial, a leading international financial services organisation, said it suffered a major data breach that affected the personal information of more than 212,000 individuals.

In a recent regulatory filing with the Office of the Maine Attorney General, the financial services giant said that one of its vendors, Pension Benefit Information, suffered a massive cyber security incident as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.

PBI provides regulatory compliance and operational support services to insurance companies, pension funds, and other organisations, including Sun Life Financial.

PBI used Progress Software’s MOVEit file transfer application to send and receive data from some of its clients and was affected by malicious exploitation of a zero-day vulnerability in the file transfer software earlier this year. The threat actors reportedly gained access to the personal information of certain members that Sun Life shared with the vendor.

“Through our investigation, we learned that the third party accessed one of our MOVEit Transfer servers on May 29, 2023 and May 30, 2023 and downloaded data. We then conducted a manual review of our records to confirm the identities of individuals potentially affected by this event and their contact information to provide notifications. We recently completed this review and shared the findings with our impacted customers,” the company said.

The compromised information included the full names of Sun Life Financial Company’s customers along with their Social security Numbers and other personal data records. The filing with the Maine Attorney General’s office also confirms that at least 212,129 individuals were affected by the data security incident.

 

"PBI advised that the personal information of certain members and account holders of our group life, long-term disability and life premium waiver insurance offered through employers, as well as individual life insurance and group pension annuities, was accessed. We confirmed the personal information accessed by hackers included name, Social Security ‎Number, policy/account number and/or date of birth of some members and account holders," Sun Life Financial said.

PBI says it is providing two years of complimentary credit monitoring, fraud consultation and identity restoration services through Kroll to all affected individuals and has set up a hotline where impacted clients can call and get their queries answered.

The PBI data breach also impacted the personal information of at least 44,400 individuals who obtained insurance services from the Loyal American Life Insurance Company, one of the largest life insurance companies in the United States. PBI said in August that the data breach also impacted more than 1.2 million customers of Connecticut-based Wilton Reassurance Life Company.