On June 30, 2023, the Vitality Group (“Vitality”) filed a notice of data breach with the Attorney General of California on behalf of Brookfield Asset Management (“Brookfield”) after discovering that a file transfer software used by Vitality contained a critical vulnerability. As a result of this vulnerability, Vitality explains that an unauthorized party could access certain Brookfield employees’ sensitive information, including their names, Social Security numbers, and other personal information. Upon completing its investigation, Vitality sent out data breach notification letters to all Brookfield employees whose information was affected by the recent data security incident.

If you received a data breach notification from the Vitality Group, it is essential you understand what is at risk and what you can do about it. Keep in mind, it’s expected that you will not have heard of the Vitality Group because this is a third-party data breach that did not involve Brookfield’s computer systems. However, if you get a data breach letter, your personal information that Brookfield provided to Vitality was compromised. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Vitality data breach. For more information, please see our recent piece on the topic here.

What Caused the Vitality Group / Brookfield Breach?

The Vitality / Brookfield data breach was only recently announced, and more information is expected in the near future. However, Vitality’s filing with the Attorney General of California provides important information on what led to the breach. According to this source, Vitality provides certain benefits-related services to Brookfield, requiring Brookfield to provide Vitality with certain confidential information about its employees. Vitality uses a file-transfer software called MOVEit, which is a product of Progress Software, LLC. On May 30, 2023, Progress discovered a critical vulnerability that allowed hackers to access information that was transferred using MOVEit.

Vitality identified the vulnerability on June 1, 2023, at which point, Vitality disconnected the MOVEit software from its server. However, upon further investigation, Vitality determined that an unauthorized party was able to access confidential information belonging to Brookfield employees.

After learning that sensitive consumer data was accessible to an unauthorized party, Vitality reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name, Social Security number and other personal information.

On June 30, 2023, Vitality, on behalf of Brookfield, sent out data breach letters to anyone who was affected by the recent data security incident. So, while the Vitality / Brookfield data breach did not involve hackers gaining access to any of Brookfield’s systems, it did result in confidential Brookfield employee information being leaked.

More Information About Brookfield Asset Management and the Vitality Group

Brookfield Asset Management is a finance company based out of Toronto, Ontario, Canada. The company focuses its investments in real estate, renewable power, infrastructure, credit and private equity. Along with its Toronto office, Brookfield also maintains offices in New York City, London, São Paulo, Mumbai, Shanghai, Dubai, and Sydney. Brookfield employs more than 200,000 people and generates approximately $3.6 billion in annual revenue.

Founded in 2005, Vitality Group International, Inc. is a healthcare software company based in Chicago, Illinois. The company provides a mobile platform that provides health and wellness updates in real-time, encouraging users to prioritize their health through incentives, data and behavioral science. Vitality’s software is used by more than 30 million people in 40 markets across the world. Vitality Group employs more than 359 people and generates approximately $99 million in annual revenue.