AETNA LIFE INSURANCE COMPANY

AETNA LIFE INSURANCE CO. filed a data-breach notice with the Illinois Attorney General in May 2024 (case 24-05-010). The register records the breach as discovered on August 21, 2023. Additional entities named: KEENAN & ASSOCIATES, ONTRAK HEALTH. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Aetna Life Insurance Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-12-09. 1 Massachusetts residents were affected. The report records the breach type as electronic.

Aetna Life Insurance Company reported a cybersecurity incident occurring on May 29, 2023, discovered on June 6, 2023. The breach involved unauthorized access via a software vulnerability in an external system. Approximately 310,019 individuals were affected, including 1,017 Maine residents. The incident compromised names and Social Security Numbers. Aetna notified affected individuals in writing starting September 14, 2023, and offered 12 months of credit monitoring and identity restoration services through Kroll.

Aetna Life Insurance Company filed a supplemental notice with South Carolina regarding a security incident involving third-party vendor Pension Benefits, LLC (dba PBI Research Services). The breach impacted a total of 5,202 South Carolina residents, an increase from the initial 4,916 reported. Notices were sent to affected individuals.

Aetna Life Insurance Company filed a supplemental notice with the Idaho Attorney General regarding a security incident involving third-party vendor Pension Benefits, LLC. The breach impacted 1,008 Idaho residents. Notices were sent to affected individuals.

Aetna Life Insurance Company reported a data breach affecting 970 Maine residents. The breach was discovered on June 6, 2023, and occurred on May 29, 2023. The incident was an external system breach due to a software vulnerability, resulting in the compromise of names and Social Security numbers. Aetna offered 12 months of credit monitoring and identity restoration services to affected individuals.

Aetna Life Insurance Company notified the Idaho Attorney General of a security incident involving its third-party vendor, Pension Benefits Information (PBI). PBI's MOVEit Transfer server was exploited, impacting 903 Idaho residents. Data included names, SSNs, and DOBs. PBI engaged Kroll for forensics and offered credit monitoring.

Aetna Life Insurance Company reported a supplemental breach involving its third-party vendor, Pension Benefits Information, LLC (dba PBI Research Services). A cyberattack exploiting a vulnerability in Progress Software's MOVEit Transfer software occurred May 29-30, 2023. PBI was notified on June 6, 2023. The incident exposed names, SSNs, DOBs, and addresses of 2,303 Washington residents. Aetna engaged Kroll for forensics and offered credit monitoring.

Pension Benefit Information, LLC notified Aetna Life Insurance Company and other clients of a MOVEit Transfer vulnerability exploited by a third party. Access occurred May 29-30, 2023. PBI patched servers, investigated, and offered 12 months of credit monitoring. Data involved included names and government IDs.

Aetna Life Insurance Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-06. 5,862 Massachusetts residents were affected. The report records the breach type as electronic.

Aetna Life Insurance Company reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-29 and was reported on 2023-09-01. 12,208 Indiana residents were affected.

AETNA LIFE INS CO. filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-631). The register records the breach as discovered on May 29, 2023. Additional entities named: MOVEIT, PBI LLC. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Aetna Life Insurance Company agreed to pay $1,000,000 to settle potential HIPAA Privacy and Security Rules violations related to three breaches. Aetna, a managed health care company, adopted a corrective action plan as part of the settlement with HHS OCR.