Lawsuit Investigation Looks into Fidelity Life Association Data Breach

Attorneys working with ClassAction.org want to hear from anyone whose data may have been compromised in a May 2023 data breach that impacted Fidelity Life Association.

Specifically, they’re investigating whether a class action lawsuit can be filed against the life insurance company in light of a recent cyberattack involving the MOVEit file transfer service used by PBI Research Services (PBI), a third-party vendor Fidelity partners with.

In a report to the Texas attorney general, Fidelity Life revealed that files accessed by cybercriminals during the data breach contained the names, addresses and Social Security numbers of individuals associated with the company.

The attorneys have reason to believe that Fidelity Life Association and its third-party vendor may have failed to implement appropriate safeguards to keep customer information confidential. They’re now looking into a class action lawsuit to help compensate victims for any harm they’ve suffered, such as identity theft or fraud.

Fidelity Life Association, PBI Data Breach: Why Did I Get a Letter?

Fidelity Life Association, an Illinois-based life insurance provider, notified the Texas attorney general around July 27 that it had experienced a data breach that impacted roughly 253,614 individuals.

In a data breach notification provided to the California attorney general, Fidelity Life attached a copy of the notice that would be sent to affected consumers. The notice reveals that the breach was part of the MOVEit file transfer system security event experienced by PBI and provides instructions on how victims can access credit monitoring services and identity theft protection.

According to a proposed class action filed against the operators of MOVEit, Ipswitch and Progress Software Corporation, the “massive” cyberattack has impacted “several hundred” companies and federal and state agencies that use the platform to share sensitive data.

The actor reportedly responsible for the breach, a ransomware group called Clop, first gained access to the MOVEit transfer servers on May 27 after exploiting a vulnerability in the platform’s software, BankInfoSecurity.com reports. DataEconomy.com says that in mid-June, the Russian-linked hacker group began listing impacted organizations on its dark web leak site and threatened to post batches of data if they failed to meet its ransom demands.

As of June 23, PBI has not been listed on Clop’s website, BleepingComputer.com reports. “While this could mean that the company is negotiating with the threat actors not to release data, it could also mean that Clop has not begun extorting the organization yet,” the cybersecurity news site says.

How Could a Lawsuit Help Data Breach Victims?

A lawsuit could also force Fidelity Life Association and its vendors to implement stronger data security practices to protect customer information from future attacks.

Before commenting, please review our comment policy.