Bankers Life—Retirement Solutions Provider—Faces Member Data Breach

Bankers Life and Casualty Company (Bankers) is a nationwide retirement solutions provider. Their services assist members in maintaining and stretching their retirement income, paying for health and treatment programs, finding excellent retirement care, and assisting families with final expenses. There are over 3,800 Bankers agents throughout the US, with most states having one or more physical branches. Thousands of families and retirees entrust their data and accounts to Bankers; however, this may change after the Bankers’ data breach announcement. 

How Did the Attack Occur? 

Although Bankers do not have a notice on their website, the Attorney General of Maine has public information regarding the incident. According to Maine’s breach filing, the event is considered an “external system breach”; however, the consumer notices published with the filing suggest the event was not a threat actor’s hack—but a cellphone swap. 

The public notices state that the event targeted a senior company officer; the perpetrators swapped his cellphone number with the threat actor’s phone number. The assailants made this event possible with a coordinated team, including a nationwide wireless carrier retailer. After the swap, the malicious actor bypassed multi-factor authentication, and all other security policies Bankers had implemented. These attacks are called “SIM swapping,” and while threat actors do not typically use them, the success of this event may signal others to copy-cat the attack. 

What Information Was Viewed or Stolen? 

The consumer notice suggests that the attack targeted Bankers’ systems; however, the threat actors did gain access to the information of over 45k members. Members and their dependents are at risk for information misuse by the assailants. The data accessed in this event includes members’ names, Social Security Numbers, birthdays, and policy numbers. The assailants could use this data in various schemes, from online impersonations to fraud, even extortion.

How Did Bankers Life and Casualty Company Admit to the Breach? 

Bankers’ timeline of the incident began around November 28th, 2023, with the discovery of the event purportedly happening the following day. Presumably, upon officials realizing the breach, they began responding to the threat, including notifying the Federal Bureau of Investigation and the United States Attorney’s Offices. Around January 26th, Bankers officials began sending impact notices to potential victims.

What Will Become of the Stolen Information? 

The compromised data may not have been the assailant’s target; however, the exposed data is in the hands of criminals. Consequently, no one can predict how the threat actors might use it. They could use victims’ identities to commit identity or medical fraud or sell the data on the dark web to make a quick profit. Moreover, now that the information is compromised, there’s no return to confidentiality. 

What Should Affected Parties Do in the Aftermath of the Breach? 

Although there is no way to hide the exposed data, victims can still influence how the threat actors can use the credentials. Victims can’t change their personal information without hassle, so they must focus on preventative rather than proactive options. They can start by securing their accounts with new passwords and contact information where necessary; additionally, they should update any accounts with matching credentials to unique strong passwords and usernames. Further, those who cannot readily watch over their accounts must consider account monitoring options. Professionals can alert victims to suspicious activity within their accounts, meaning more significant mitigation and a faster return to normalcy. Victims shouldn’t wait for their impact notice to start taking action. They can start safeguarding their and their family’s data today.