Recently, Colonial Life & Accident Insurance Company filed an official report of a data breach impacting tens of thousands of individuals. According to the most recent filing by Colonial Life, the breach resulted in the names, Social Security numbers, addresses, financial account information and protected health information being compromised. On May 23, 2022, Colonial Life sent out data breach letters to all affected parties, informing them of the incident.

If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Colonial Life data breach, please see our recent piece on the topic here.

What Is Known About the Colonial Life Data Breach

The Colonial Life & Accident Insurance Company data breach was only very recently reported. Thus, very little is known about the details of the breach and what led up to the incident. However, according to the company’s initial filing, the Colonial Life breach resulted in the following consumer data being compromised:

• Names,

• Addresses,

• Social Security numbers,

• Driver’s license numbers,

• Government-issued identification numbers,

• Financial account information,

• Medical information, and

• Health information.

On May 23, 2022, Colonial Life sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.

Colonial Life & Accident Insurance Company is an insurance company based in Columbia, South Carolina. Colonial Life provides a wide range of insurance products, including life insurance, disability insurance, cancer insurance, critical care insurance, and health and dental insurance. The company was founded in 1937 and operated independently until 1993, when it became a wholly-owned subsidiary of Unum Group, a Tennessee-based insurance company. Colonial Life employs more than 11,200 people and generates approximately $5 billion in annual revenue.

Do Businesses Have a Duty to Report Data Breaches?

Yes, every state has laws on the books requiring companies to provide notice of a data breach to consumers whose information was affected by a breach. However, just because a breach occurred does not necessarily mean that a company needs to report it. As a general rule, most states’ laws only require companies to disclose breaches that affect consumers’ personally identifiable information.

However, because federal law does not contain a data breach notification requirement, there is no universal definition of what constitutes “personally identifiable information,” as it is up to each state to define the term. The result is that a breach that must be reported in one state may not need to be reported in another state.

Typically, the intent of the data breach notification requirement is two-fold. First, receiving notice of a data breach gives consumers the opportunity to mitigate the potential harms associated with the breach by taking the appropriate actions. Often, this includes closing compromised accounts, re-issuing credit cards, signing up for credit monitoring, and closely monitoring one’s financial accounts and credit reports.

The second goal of data breach notification laws is to encourage companies to step up to the plate when it comes to implementing a robust data security system. If companies know that they must report a data breach, they will likely be more careful in how they handle consumer information for fear of public backlash. In this way, strict data breach reporting laws can actually decrease the number of breaches.

If you were impacted by a recent data breach and want to learn more about your rights and potential remedies, reach out to a data breach lawyer for assistance.