On October 23, 2023, Andesa Services (“Andesa”) filed a notice of data breach with the Attorney General of Maine on behalf of New York Life Insurance Company (“New York Life”) after confirming that the widely-known MOVEit vulnerability impacted more than 30,000 New York Life policyholders. In this notice, Andesa explains that the incident resulted in an unauthorized party being able to access policyholders’ sensitive information, which includes their names and Social Security numbers. Upon completing its investigation, Andesa began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you receive a data breach notification from Andesa Services or New York Life Insurance Company, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft, as well as discuss your legal options following the Andesa / New York Life Insurance Company data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting New York Life Insurance Company Policyholders?

The Andesa data breach was only recently announced, and more information is expected in the near future. However, the company’s filing with the Attorney General of Maine provides some important information on what led up to the breach. According to this source, Andesa performs administrative services for employer-owned or sponsored New York Life insurance policies. In the normal course of business, Andesa uses a secure file-transfer application called MOVEit.

On May 31, 2023, Progress Software, the creator of MOVEit, announced a critical vulnerability within the program. Upon discovery, Andesa applied all available patches and took the necessary steps to mitigate any potential unauthorized access. Andesa also launched an investigation into the incident with the help of third-party data security specialists.

The Andesa investigation confirmed that an unauthorized actor was able to access its MOVEit server between May 30, 2023 and May 31, 2023, as well as the sensitive data stored on the server.

After learning that sensitive consumer data was accessible to an unauthorized party, Andesa reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name and Social Security number.

On October 23, 2023, Andesa sent out data breach letters to anyone who was affected by the recent data security incident. These letters should provide victims with a list of what information belonging to them was compromised.

More Information About Andesa Services

Andesa Services is a business services company that caters to the insurance industry. More specifically, Andesa provides policy lifecycle solutions for the life insurance and annuities industry, relying on cloud-based systems for transaction management and recordkeeping. Andesa Services also provides product and actuarial support services. Andesa Services employs more than 136 people and generates approximately $20 million in annual revenue.