CNA FINANCIAL CORPORATION

CNA Financial Corporation reported a ransomware attack discovered on March 21, 2021. The threat actor accessed systems starting March 5, 2021, via a fake browser update, stole credentials, and exfiltrated data to a Mega account before deploying ransomware. 205 New Hampshire residents were affected, with data including names, SSNs, and some PHI. CNA recovered the data and reported to the FBI. Notification began July 9, 2021.

CNA Financial Corporation notified Montana residents of a ransomware attack discovered on March 21, 2021. The threat actor accessed systems between March 5-21, 2021, copying limited personal information (name, SSN) before deploying ransomware. CNA recovered the data, found no evidence of misuse, and reported the incident to the FBI. Affected individuals were offered 24 months of Experian IdentityWorks.

CNA Financial Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2021-07-09. The breach occurred during 3/5/2021 - 3/21/2021. The breach was discovered on 3/21/2021. 75,349 individuals were affected. Notice was sent on 7/9/2021.

CNA Financial Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2021-03-05 and was reported on 2021-07-09. 1,958 Indiana residents were affected. 75,349 individuals affected in total.

CNA Financial Corporation suffered a sophisticated ransomware attack. The threat actor accessed systems from March 5 to March 21, 2021, copying a limited amount of data before deploying ransomware. CNA discovered the incident on March 21, 2021. Affected data included names and Social Security numbers. CNA engaged cybersecurity firms, notified the FBI, and implemented security enhancements. Complimentary identity monitoring was offered to affected individuals.

CNA Financial Corporation reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-07-08. 1,206 Massachusetts residents were affected. The report records the breach type as electronic.

CNA Financial Corporation (IL), a Health Plan, reported to HHS OCR on 2021-07-08 a ransomware attack affecting PHI of approximately 5,095 individuals. Breached information was located on a Network Server. PHI exposed included names, addresses, Social Security numbers, birthdates, diagnoses, lab results, and claims/treatment information. The CE notified HHS, affected individuals, media, and law enforcement. OCR provided technical assistance regarding the HIPAA Security Rule. No business associate was involved.

CNA Financial Corporation reported an external system breach (hacking) occurring between March 5, 2021, and March 21, 2021. The incident affected 75,349 individuals, including 96 Maine residents. Acquired information included names and Social Security Numbers. CNA provided 24 months of credit monitoring through Experian and a toll-free hotline.

CNA Financial Corporation reported a ransomware attack affecting 823 Washington residents. The threat actor gained access via a fake browser update (phishing link) on March 5, 2021, moved laterally using stolen credentials, and deployed ransomware on March 21, 2021. Data (names, SSNs, some PHI) was exfiltrated to a Mega account but recovered; no evidence of misuse was found. Notifications began July 9, 2021.