On July 14, 2023, Athene Annuity and Life Company filed a notice of third-party data breach with the Attorney General of Maine after learning that a vendor used by Athene, Pension Benefit Information, LLC (“PBI”), experienced a data breach related to the popular file transfer application MOVEit. The filing included a sample template prepared by PBI, which explained that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, including their names and Social Security numbers. Upon completing its investigation, PBI began sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from Pension Benefit Information referencing information provided to Athene Annuity and Life Company, it is essential you understand what is at risk and what you can do about it. As we’ve discussed in prior posts, data breaches involving your Social Security number are particularly concerning because hackers need little more than your SSN to commit identity theft and other frauds against you. However, by being proactive, you can reduce many of the risks you face in the wake of a data breach. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Athene Annuity and Life data breach.

What Caused the Athene Annuity and Life Breach?

The Athene Annuity and Life data breach was only recently announced, and more information is expected in the near future. However, Athene’s filing with the Attorney General of Maine provides some important information on what led up to the breach. According to this source, PBI provides audit and address research services for insurance companies, pension funds, and other organizations, including Athene. In order to allow PBI to perform these contracted services, Athene provides PBI with confidential information about its customers.

PBI uses MOVEit, a file sharing program developed by Progress Software. On May 31, 2023, Progress Software disclosed a vulnerability in MOVEit that had been exploited by an unauthorized third party. In response, PBI launched an investigation into the incident.

The PBI investigation confirmed that an unauthorized party accessed PBI’s MOVEit servers on May 29, 2023 and May 30, 2023, and downloaded data, including some data pertaining to Athene customers.

After learning that sensitive consumer data was accessible to an unauthorized party, PBI reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include your name and Social Security number.

On July 14, 2023, Athene Annuity and Life filed notice of the breach with the Maine Attorney General. However, it appears that PBI will be sending out data breach notices to affected Athene customers.