Globe Life Inc.

Globe Life Inc. filed an amended Form 8-K (Item 8.01) supplementing its October 17, 2024 disclosure that it received communications from an unknown threat actor seeking to extort money from the company in exchange for not disclosing certain information held and used by the company and its independent agents. The company says it verified the threat actor had obtained personally identifiable information of approximately 5,000 individuals, including names, email addresses, phone numbers, postal addresses and, in some instances, dates of birth, Social Security numbers, health-related data and other insurance policy information, and that certain of this data was distributed to short sellers and plaintiffs' attorneys; the exposure did not include personally identifiable financial information. The customer information was traced to databases maintained by a small number of independent agency owners. Out of an abundance of caution, the company initiated the process to provide voluntary notifications and credit monitoring to approximately 850,000 additional individuals whose information was stored in those databases, although it has not been able to confirm that their data was acquired. The company did not pay the extortion demand, says the attempts did not involve ransomware or interrupt its systems or operations, notified federal law enforcement, will seek reimbursement from its insurers, and does not expect a material impact.

Globe Life Inc. disclosed in a voluntary Item 8.01 Form 8-K that an unknown threat actor sought to extort the company in exchange for not disclosing information held by the company and its independent agents. Globe Life activated its incident response plan, engaged external counsel and cybersecurity experts, and reported the extortion attempt to federal law enforcement. The company's ongoing investigation indicates the information may relate to customers and customer leads traceable to its subsidiary, American Income Life Insurance Company, and includes PII such as names, email addresses, phone numbers, postal addresses, and in some instances Social Security numbers, health-related data, and other policy information for approximately 5,000 individuals — a figure the company states has not been fully verified. The threat actor also shared information on a limited number of individuals with short sellers and plaintiffs' attorneys, and claims to possess additional, unverified categories of information. The company states the extortion did not involve ransomware or any interruption to its systems or operations, and that it does not expect a material impact.

Globe Life Inc. disclosed on June 14, 2024 (Item 8.01) that following an inquiry from a state insurance regulator, it initiated a review of potential vulnerabilities related to access permissions and user identity management for a Company web portal that likely resulted in unauthorized access to certain consumer and policyholder information. The Company removed external access to the portal, activated its incident response plan, and retained security experts. The full scope is not yet known; not yet determined as material under Item 1.05.