Fidelity Says Vendor Breach Affected Over 28,000 Life Customers

The LockBit ransomware group may have taken the bank account and routing numbers of thousands of Fidelity Investments life insurance customers when it hacked the systems of a Fidelity vendor last fall.

Fidelity told officials in Maine and California about the data breach in notices filed Friday.

The LockBit group hit the computers of Infosys McCamish Systems, a company that provides information technology support for many life insurers. The McCamish held records for 28,268 Fidelity Investments Life policyholders when the attack occurred.

McCamish is still investigating the incident and is “unable to determine with certainty what personal information was accessed,” Fidelity Investments Life says in a letter that started going out to its policyholders Friday. “However, based on information recently provided by McCamish to [Fidelity Investments Life], we believe that the following information related to you was likely acquired by the third party: your name, Social Security number, state of residence, bank account and routing number (if you provided that information to us to make premium payments on your life insurance policy) and date of birth.”

What it means: In the near future, more of your clients may be coming to you with questions about data breach notices.

In the long run, getting through online financial systems’ identity verification systems might become even more complicated.

Fidelity Investments Life: Fidelity acquired its life insurance business — the former Independence Square Life Insurance Co. — in 1986, then renamed it and moved its official state of domicile to Utah, from Pennsylvania, in 1992.

The company writes term life and some other products for its parent company’s customers, and it distributes life and annuity products written by other companies. It reported $102 million in net income in 2022 on $1.7 billion in revenue and $36 billion in assets.

Infosys McCamish Systems: McCamish is part of Infosys Ltd., a Bangalore-based outsourcing company with about 300,000 employees.

McCamish itself is based in Atlanta. It reported $34 million in profits in 2022 on $462 million in revenue.

Fidelity’s life unit discloses in registration statements for its variable life funds that cyberattacks could hurt its operations and its funds.