MOVEit Hack Hit These Life, Annuity and Retirement Firms

The attack this year on the MOVEit file transfer system by the Cl0P ransomware gang has been especially cruel to your favorite clients.

The attack hit the conscientious people who buy life insurance to protect their loved ones; use life insurance, annuities or individual investment accounts to save for a dignified retirement; or participate in employer-sponsored retirement plans.

The Cl0P hackers got at those clients by finding and using a weakness in MOVEit, a tool from Progress Software that organizations use to move big batches of sensitive data.

MOVEit has a diverse user base, including weather researchers and the military.

Progress notes that it disclosed the vulnerability the hackers exploited May 31 and deployed a patch the same day.

Why Did the MOVEit Breach Affect So Many Insurance Companies?

MOVEit is a tool that’s as common as shoes and socks at financial services companies, partly because PBI Research Services, a dominant player in the death audit services market, uses MOVEit to help companies determine whether insurance policy owners, annuity contract owners, investment account owners and retirement plan participants are still alive.

At least 1,006 organizations have reported MOVEit-related breaches as of Aug. 28, according to KonBriefing Research. Those reports have affected more than 49 million people.

What Happens Now?

In 2021, a typical U.S. Social Security number sold for about $2, meaning that, in theory, the MOVEit hack victims’ numbers could be worth about $80 million on the resale market.

Whatever personal information was stolen may now be available for free, to people who know how to find it and use it, because Cl0p said earlier this month that it was dumping all of the records it hacked on the web, according to press reports.

Cybersecurity experts have suggested that organizations like Cl0p may try to supplement revenue from selling hacked personal data by trying to persuade affected companies to pay ransoms, to avoid having hacked data exposed.

Many financial services organizations are still trying to determine whether they were breached and how to report a breach. Most Cl0p breach size information comes from companies that happened to send reports to the Office of the Maine Attorney General, which posts a breach list that includes national impact estimates.

If organizations have reported breaches only to a state like California or Maine, national estimates of the number of people affected by those breaches may be unavailable.

Here’s a list of the MOVEit-related life, annuity, asset management, retirement services and support services organization breaches we could find, based on the breach feeds provided by Maine, California and other states, and on disclosure notices some companies filed with the U.S. Securities and Exchange Commission.

We excluded local banks, credit unions, health insurers, property and casualty insurers, and we included some organizations outside the retirement services sector, like Maximus, a major Medicare and Affordable Care Act public exchange services vendor, because of their importance to retirees’ and near retirees’ lives. We will update this list as more information becomes available.

Some companies consolidate breach reporting at the parent-company level. Others report through subsidiaries, through vendors or through a combination of two or more strategies.

As of Aug. 28, the breach reports summarized here that include national customer impact estimates show that more than 26 million people may have been affected.

The current estimates of the number of people affected could include a significant amount of double counting, with some accounts reported by several different entities, and some people owning two or more separate affected accounts. But this list also includes many entities for which national impact estimates were not readily available.

American National Group

Date reported: Aug. 9

Number of people or accounts who could be at risk: Not available

Identity protection service offered: Experian IdentityWorks

Athene Annuity and Life Co. and its affiliates

Date reported: July 20

Number of people or accounts who could be at risk: 70,412

Identity protection service offered: Kroll

Aurora National Life Assurance Co. (Reinsurance Group of America)

Date reported: July 21

Number of people or accounts who could be at risk: 48,457

Identity protection service offered: Norton LifeLock’s LifeLock Defender

California State Teachers’ Retirement System

Date reported: March 24

Number of people or accounts who could be at risk: NA

Identity protection service offered: Experian IdentityWorks

CalPERS

Date reported: June 22

Number of people or accounts who could be at risk: 769,000

Identity protection service offered: Experian IdentityWorks

Charles Schwab & Co.

Date reported: June 9

Number of people or accounts who could be at risk: NA

Identity protection service offered: TransUnion IdentityForce

Clear Spring Life and Annuity Company (Group 1001)

Date reported: July 27

Number of people or accounts who could be at risk: 4,393

Identity protection service offered: IDX

Club Vita US

Date reported: Aug. 10

Number of people or accounts who could be at risk: 4,821

Identity protection service offered: Kroll

Continental General Insurance

Date reported: Aug. 28

Number of people or accounts who could be at risk: 38,886

Identity protection service offered: Kroll

EP Global Production Solutions

Date reported: Aug. 11

Number of people or accounts who could be at risk: 471,362

Identity protection service offered: Kroll

Ernst & Young

Date reported: Aug. 9

Number of people or accounts who could be at risk: 30,210

Identity protection service offered: Experian

Fidelity & Guaranty Life Insurance Co.

Date reported: July 20

Number of people or accounts who could be at risk: 873,000

Identity protection service offered: Kroll

Fidelity Investments

Date reported: July 12

Number of people or accounts who could be at risk: 371,359

Identity protection service offered: Kroll

Fidelity Life Association

Date reported: Aug. 9

Number of people or accounts who could be at risk: 250,000

Identity protection service offered: Kroll

Genworth

Date reported: July 27

Number of people or accounts who could be at risk: 2,500,000

Identity protection service offered: Kroll

Group 1001 Resources

Date reported: July 28

Number of people or accounts who could be at risk: 3,169

Identity protection service offered: IDX

Hartford Life and Accident Insurance Co.

Date reported: Aug. 3

Number of people or accounts who could be at risk: 713,264

Identity protection service offered: Kroll

Jackson National

Date reported: June 20

Number of people or accounts who could be at risk: 850,000

Identity protection service offered: Kroll

Lumico Life Insurance Co., Elips Life Insurance Co.

Date reported: Aug. 1

Number of people or accounts who could be at risk: Not available

Identity protection service offered: Kroll

Massachusetts Mutual Life Co.

Date reported: July 19

Number of people or accounts who could be at risk: 242

Identity protection service offered: Kroll

Maximus

Date reported: July 28

Number of people or accounts who could be at risk: 8,000,000

Identity protection service offered: Experian IdentityWorks

Milliman Solutions

Date reported: July 17

Number of people or accounts who could be at risk: 1,280,823

Identity protection service offered: Kroll

MOVEit file transfer software from Progress

Date reported: Aug. 9

Number of people or accounts who could be at risk: 4,457

Identity protection service offered: Experian IdentityWorks