Prudential Data breach impacts More than 2.5 million individuals

Prudential Financial has recently updated its notification regarding the February 2024 data breach, now revealing that over 2.5 million individuals have been affected. This breach initially disclosed in a February filing with the US Securities and Exchange Commission, was initially estimated to impact over 36,000 individuals.

As one of the largest insurance companies in the US, Prudential, employs 40,000 people worldwide and reported revenues of over $50 billion in 2023. However, an updated incident notice filed with the Maine Attorney General’s Office last week indicates that the number of compromised individuals stands at 2,556,210.

The Date of Breach was February 4, 2024 and was discovered on  February 5, 2024.

At that time, Prudential disclosed that the attackers gained access to systems containing company administrative and user data, as well as employee and contractor accounts. Sources said, the data breach notification states that the company will be giving affected customers 24 months of identity theft and credit monitoring services through Kroll.

Kroll provides your breach population with direct access to investigative experts for live support and best practice advice, as well as identity restoration, should they become victims of identity theft.

Prudential’s incident response plan was activated immediately, and an investigation was conducted in collaboration with external cybersecurity experts. Those impacted by the breach are being offered two years of free credit monitoring services to mitigate potential damage from the stolen information.

The Legal Actions taken were - A class action lawsuit was filed against Prudential in June 2024 in a New Jersey federal court, reflecting the serious implications of the breach.

A week later, the Alphv/BlackCat ransomware group took responsibility for the attack and listed Prudential on its Tor-based leak site. This group was also behind a significant outage in the US health system last month after targeting Change Healthcare systems and services.

Whereas, the individuals affected by the Prudential breach are being notified of the incident through written notifications. Among the compromised data are names or other personal identifiers in combination with driver’s license numbers or non-driver identification card numbers.