On July 27, 2023, T. Rowe Price Retirement Plan Services, Inc. (“TRP”) filed a notice of data breach with the Attorney General of Montana after discovering that hackers accessed a MOVEit server belonging to Pension Benefit Information, LLC (“PBI”), one of TRP’s third-party vendors. In this notice, TRP explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information. Upon completing its investigation, TRP began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from PBI or T. Rowe Price Retirement Plan Services, Inc., it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the PBI / T. Rowe Price Retirement Plan Services data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting T. Rowe Price Retirement Plan Services Customers?

The PBI / T. Rowe Price Retirement Plan Services data breach was only recently announced, and more information is expected in the near future. However, this is not the first data breach involving PBI and the company’s use of MOVEit. Additionally, TRP’s filing with the Attorney General of Montana provides some important information on what led up to the breach.

Evidently, PBI performs certain services as a vendor for T. Rowe Price Retirement Plan Services. Throughout the normal course of business, PBI uses a file transfer program called MOVEit to transfer certain information, some of which is confidential.

On approximately May 31, 2023, the developer of MOVEit confirmed that the software contained a critical vulnerability. This vulnerability, if exploited, allowed unauthorized parties to access MOVEit servers belonging to companies that use the product. PBI’s MOVEit server was one of those that was accessed by an unauthorized party.

Upon learning about the incident, PBI conducted an investigation, ultimately confirming that certain information provided to PBI by TRP was subject to unauthorized access.

After learning that sensitive consumer data was accessible to an unauthorized party, PBI reviewed the compromised files to determine what information was leaked and which consumers were impacted. On July 14, 2023, PBI provided T. Rowe Price Retirement Plan Services with a list of individuals who were affected by the breach and what information was involved.

On July 27, 2023, T. Rowe Price Retirement Plan Services sent out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.

More Information About T. Rowe Price Retirement Plan Services, Inc.

T. Rowe Price Retirement Plan Services, Inc. is a division of the large financial services company T. Rowe Price. TRP Retirement Plan Services focuses on providing a range of retirement plan options to clients, including more than 90 proprietary mutual funds, nonproprietary investment options, and brokerage services. T. Rowe Price is based in Baltimore, Maryland, employing more than 7,573 people and generating approximately $7.7 billion in annual revenue.