On July 13, 2023, Sun Life Assurance Company of Canada (“Sun Life”) posted a notice on its website describing a third-party data breach resulting from a third-party vendor’s use of the MOVEit file transfer software. In this notice, Sun Life explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names, Social Security Numbers, policy numbers, account numbers and dates of birth. Once Sun Life and its vendor, Pension Benefit Information, complete their respective investigations, the companies will begin sending out data breach notification letters to all individuals whose information was affected by the recent data security incident.

If you received a data breach notification from Sun Life Assurance Company of Canada or Pension Benefit Information, LLC, it is essential you understand what is at risk and what you can do about it. A data breach lawyer can help you learn more about how to protect yourself from becoming a victim of fraud or identity theft as well as discuss your legal options following the Sun Life data breach. For more information, please see our recent piece on the topic here.

What Caused the Data Breach Affecting Sun Life?

The data breach impacting Sun Life members and account holders was only recently announced, and more information is expected in the near future. However, Sun Life’s website notice provides some important information on what led up to the breach. According to this source, Sun Life was recently informed that one of its third-party vendors, Pension Benefit Information (“PBI”), experienced a data breach related to MOVEit, a popular file transfer application.

Earlier this year, Progress Software, the creator of MOVEit, announced that the program contained a critical vulnerability that allowed hackers to access data stored on MOVEit servers, including PBI’s. Because of this, some personal information belonging to U.S. Sun Life customers that had been shared with PBI was accessed.

Upon learning of the vulnerability, PBI launched an investigation into the incident, confirming that one of its servers was accessed by an unauthorized third party. Once PBI informed Sun Life of the incident, Sun Life decided to conduct its own investigation alongside PBI to confirm what data was involved.

Sun Life and PBI are still in the process of identifying the leaked information and which consumers were affected. However, Sun Life notes that while the breached information will likely vary for each individual, it may include your name, Social Security Number, policy number, account number and date of birth.

Once Sun Life completes its investigation and confirms the names and addresses of all affected parties, the company will work with PBI to send out data breach letters to those whose information was leaked as a result of the PBI / MOVEit data breach.

More Information About Sun Life Assurance Company of Canada

Founded in 1865, Sun Life Assurance Company of Canada is an international financial services organization based out of Toronto, Ontario, Canada. Sun Life provides a range of protection and wealth products and services to individuals, businesses and institutions, including insurance, investments, advice, and asset management. Sun Life is listed on the Toronto (TSX), New York (NYSE) and Philippine (PSE) stock exchanges under the symbol “SLF.” Sun Life employs more than 42,000 people and generates approximately $23 billion in annual revenue.