On August 8, 2023, Global Atlantic Financial Group (“Global Atlantic”) filed a notice of data breach with the Attorney General of Massachusetts after discovering a MOVEit-related data breach at Pension Benefit Information, LLC, one of Global Atlantic’s third-party vendors. In this notice, Global Atlantic explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names, Social Security numbers, policy numbers, dates of birth, genders, and addresses. Upon completing its investigation, PBI / Global Atlantic began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from Pension Benefit Information or Global Atlantic Financial Group, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Global Atlantic data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Global Atlantic?

The PBI / Global Atlantic data breach was only recently announced, and more information is expected in the near future. However, Global Atlantic’s filing with the Attorney General of Massachusetts provides some important information on what led up to the breach. Global Atlantic also posted a notice entitled “PBI-MOVEit Cybersecurity Incident” on its website.

According to these sources, PBI is a third-party vendor that Global Atlantic uses to satisfy applicable regulatory obligations to identify the deaths of insured persons. In the normal course of business, PBI uses a secure file transfer program called MOVEit. On May 31, 2023, the creator of MOVEit announced a previously unknown vulnerability that allowed unauthorized parties to access companies’ MOVEit servers. PBI was among the companies affected by the MOVEit vulnerability.

After learning about the vulnerability, PBI launched an investigation, confirming that unauthorized parties were able to access the PBI MOVEit server on May 29, 2023 and May 30, 2023. The unauthorized parties viewed and downloaded certain confidential data belonging to Global Atlantic customers.

After learning that sensitive consumer data was accessible to an unauthorized party, Global Atlantic worked with PBI and outside cybersecurity professionals to review the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name, Social Security number, policy number, date of birth, gender, and address.

On August 8, 2023, data breach letters were sent to anyone affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.

Please note that Global Atlantic’s environment was not compromised as a part of this incident. Any compromised data was stored on PBI’s MOVEit server.

More Information About Global Atlantic Financial Group

Global Atlantic Financial Group is a life insurance and annuity company based in New York, New York. Global Atlantic was formed at Goldman Sachs in 2004 but became an independent, privately held company in 2013. Subsequently, in February 2021, KKR acquired a majority ownership stake in Global Atlantic, which now operates as a subsidiary and standalone business. Global Atlantic employs more than 1,200 people and generates approximately $1.1 billion in annual revenue.