GEICO Finds Employee Personal Data Exfiltrated via 2023 MOVEit Breach

The Government Employees Insurance Company (GEICO) is a privately owned insurance group with 18 branches in the US. They provide insurance plans for all aspects of life, including auto, motorcycle, travel, pet, homeowner, renter, and jewelry options. GEICO employs over 38,000 people nationwide, many of whom receive discounted prices for their insurance. GEICO also offers dental insurance to its employees through Delta Dental of California (DDC) and affiliates. DDC was one of thousands of organizations that utilized Progress Software’s MOVEit file transfer tool in 2023. As a result, over 70k GEICO employees and affiliates have had their information compromised. 

How Did the Attack Occur? 

The MOVEit breach came from a zero-day vulnerability that allowed threat actors to access the networks of organizations using the tool. Cybersecurity experts first made Progress Software aware of the vulnerability in May of 2023 and, shortly after that, announced the breach publicly. Immediately after the announcement, thousands of organizations worldwide opened investigations into their systems, including DDC. Currently, there is no public information about the assailant that accessed DDC’s MOVEit system; however, those impacted by the breach must still act to safeguard their data. 

What Information Was Viewed or Stolen? 

The information stolen in this event is confidential; further, the public breach filing for the incident—published by the Maine Attorney General—offers little detail about the compromised data elements. The filing lists individuals’ stolen driver’s licenses or government-issued ID numbers, but the event likely exposed more. The Maine Attorney General’s Office also publishes sample consumer notices associated with these filings; however, the notice published with this filing is the same as the one published for DDC. Consequently, there are no other indications of breached data elements despite signs that additional elements are compromised.

How Did GEICO Corporation Admit to the Breach? 

Progress Software announced the MOVEit breach at the end of May 2023. According to the DDC’s investigation, the assailants accessed the related GEICO file system around this time, between May 27th and May 30th. Around June 1st, DDC was alerted to the MOVEit event and opened an investigation into their systems. Over a month later, around July 6th, DDC confirmed that the assailants accessed and removed files from their MOVEit server. DDC officials eventually notified GEICO of their breach around December 22nd. GEICO immediately notified the proper parties, including sending impact notices around January 29th, 2024.

What Will Become of the Stolen Information? 

Predicting what will happen to the compromised information from this breach is challenging. The difficulties come from a lack of details; the public doesn’t know what information the event compromised (besides IDs), so we cannot predict how the faceless assailants may use it. However, the DDC’s sample notice—published with the GEICO filing—suggests that impacted parties consider identity, account and financial monitoring services. These resources may indicate the threats that victims now face due to the event, which means that the threat actors may have accessed more information than ID numbers.

What Should Affected Parties Do in the Aftermath of the Breach? 

Victims of this breach have a choice; they can wait until their physical notices arrive with a list of impacted data elements or act before the notice arrives. At a minimum, victims must secure their accounts. Strong, unique passwords, especially those generated by password managers, are necessary for all accounts. Those profiles should also receive increased security options, including multi-factor authentications and one-use tokens whenever possible. Moreover, the MOVEit event happened months ago, but victims can still take action to protect themselves, with or without a physical notice.