Fidelity Says Vendor Breach Affected Over 28,000 Life Customers

The unit "cannot control the cyber security plans and systems put in place by its service providers or any other third parties whose operations may affect its business," the company warns in one of the registration statements.

In 2022, Fidelity Investments Life paid McCamish $719,704 for administrative services, according to the registration statement.

The LockBit attack: LockBit, a ransomware group in law enforcement that's been getting law enforcement attention since 2019, broke into IMS systems around Oct. 29, 2023.

The group announced on X, formerly Twitter, that it had taken 50 gigabytes of IMS data.

The attack has affected both life insurers that use IMS systems directly and life insurers with ties to IMS systems through administrative services vendors. In February, Bank of America and Northwestern Mutual announced that up to 80,000 of their customers were affected by the LockBit IMS attack through the impact of the attack on an executive retirement plan administrator.

Infosys said in its latest quarterly earnings report that the attack had resulted in the non-availability of some McCamish applications and systems.

"McCamish initiated its incident response and engaged cybersecurity and other specialists to assist in its investigation of and response to the incident and remediation and restoration of impacted applications and systems," Infosys said. "By Dec. 31, 2023, McCamish, with external specialists' assistance, substantially remediated and restored the affected applications and systems."

The attack has cost IMS $30 million so far, Infosys said.

The FBI and the U.K. National Crime Agency announced last week that they had seized many LockBit websites.

The Fidelity Investors Life perspective: Fidelity Investments Life said in a comment about the incident that it "has started notifying certain customers that their information may have been compromised in a cybersecurity incident that occurred at Infosys McCamish Systems, a vendor used by FILI."

"This incident is not the result of any issues with Fidelity's systems or any breach of Fidelity's environment," the company said. "We take the protection of customer information seriously and we continue to be in contact with Infosys McCamish Systems and will take appropriate actions as needed."

Remediation: Fidelity Investments Life said affected policyholders will get 24 months of credit monitoring and identity theft restoration services through TransUnion.

Credit: Shutterstock