On July 20, 2023, Pension Benefits Information (“PBI”) filed a notice of data breach on behalf of Willis Towers Watson US LLC (“WTW”) with the Attorney General of Massachusetts after discovering that experienced a MOVEit-related breach at PBI affected confidential information that had been provided to WTW. In this notice, PBI explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names and Social Security numbers. Upon completing its investigation, PBI began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you receive a data breach notification from Pension Benefit Information, LLC, it is essential you understand what is at risk and what you can do about it. Even if you haven’t heard of PBI, the company ended up with your data as a result of the services it provides to WTW. As a result, your personal information may now be in the hands of criminals looking to steal your identity or commit other frauds against you. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the PBI / Willis Towers Watson data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Willis Towers Watson?

The PBI / Willis Towers Watson data breach was only recently announced, and more information is expected in the near future. However, PBI’s filing on behalf of provides some important information on what led up to the breach. According to this source, PBI provides audit and address research services for insurance companies, pension funds, and other organizations, including Willis Towers Watson. PBI also uses a secure file transfer service called MOVEit, which was created by Progress Software.

On May 31, 2023, Progress Software announced that MOVEit contained a critical vulnerability. This vulnerability allowed unauthorized parties to access the MOVEit servers of companies that use the software, including PBI.

Upon learning of the vulnerability in MOVEit, PBI launched an investigation to determine what, if any, WTW data was compromised. PBI’s investigation confirmed an unauthorized actor was able to access certain files on its MOVEit server related to WTW customers.

After learning that sensitive consumer data was accessible to an unauthorized party, PBI reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name and Social Security number.

On July 20, 2023, PBI sent out data breach letters on behalf of Willis Towers Watson to anyone who was affected by the recent data security incident.

More Information About Willis Towers Watson US LLC

Founded in 2016 from the merger of Willis Group and Towers Watson, Willis Towers Watson is a business services and insurance company. The company’s U.S. operations are based out of Arlington, Virginia, with its main headquarters in London, U.K. Willis Towers Watson employs more than 46,600 people and generates approximately $9 billion in annual revenue.