CLEAR SPRING LIFE AND ANNUITY COMPANY

Supplemental state-AG notice (NH, Dec 26, 2023) regarding a ransomware incident affecting Clear Spring Life and Annuity Company (CSLAC), which administers policies for First Security Benefit Life Insurance (FSBL). Discovered Feb 9, 2023, the breach impacted 4,393 individuals total, including 4 New Hampshire residents. CSLAC notified the FBI, did not pay ransom, and provided 2 years of free credit monitoring/identity protection via IDX. Initial notice was July 27, 2023; supplemental notice covers 3 additional NH residents notified Nov 21, 2023.

Clear Spring Life and Annuity Company reported a data breach to the Oregon Attorney General. The breach was reported on 2023-11-21. The breach occurred during 11/30/2022 - 2/9/2023. The breach was discovered on 1/1/0001. 64,786 individuals were affected. Notice was sent on 7/28/202311/21/2023.

Clear Spring Life and Annuity Insurance Company experienced a ransomware attack. The California OAG form lists the breach date as November 30, 2022. The company discovered sophisticated ransomware on February 9, 2023. An unauthorized actor accessed and acquired files containing names, addresses, dates of birth, and Social Security numbers of policyholders and agents. The company engaged forensic investigators, notified the FBI, and is offering 24 months of identity protection services.

Clear Spring Life and Annuity Company experienced a ransomware attack. The company was alerted to sophisticated ransomware on February 9, 2023. An unauthorized actor accessed and acquired files containing personal information including names, addresses, dates of birth, and Social Security numbers. The breach date listed by the CA AG is November 30, 2022. The company engaged forensic experts, notified the FBI, and is offering 24 months of identity protection services.

First Security Benefit Life Insurance and Annuity Company of New York reported a ransomware incident involving Clear Spring Life and Annuity Company (CSLAC). On February 9, 2023, CSLAC detected sophisticated ransomware. The incident affected 4,393 individuals, including 3 New Hampshire residents. Personal information was accessed and exfiltrated. CSLAC engaged forensic investigators, notified the FBI, did not pay ransom, and provided credit monitoring services to affected individuals. Notices were sent to NH residents on July 28, 2023.

Clear Spring Life and Annuity Company reported a data breach to the Indiana Attorney General. The breach occurred on 2022-11-30 and was reported on 2023-07-28. 3,070 Indiana residents were affected. 63,045 individuals affected in total.

Clear Spring Life and Annuity Company notified Vermont AG of a ransomware incident discovered on Feb 9, 2023. An unauthorized actor accessed files containing names, SSNs, DOBs, and policy numbers. The company engaged forensic investigators, notified the FBI, and is offering 24 months of identity theft protection services to affected individuals.

Clear Spring Life and Annuity Company reported a ransomware cyberattack affecting 1,125 Washington residents. Unauthorized access occurred between Nov 30, 2022, and Feb 9, 2023. Data exposed included names, addresses, DOBs, SSNs, and policy numbers. The company engaged forensic investigators, notified the FBI, and offered 24 months of identity protection services.

Clear Spring Life and Annuity Company reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-07-28. 1,292 Massachusetts residents were affected. The report records the breach type as electronic.

Clear Spring Life and Annuity Company reported a data breach to the Oregon Attorney General. The breach was reported on 2023-07-28. The breach was discovered on 2/9/2023. 63,045 individuals were affected. Notice was sent on 7/28/2023.

Clear Spring Life and Annuity Company experienced a ransomware incident. On February 9, 2023, the company detected sophisticated ransomware on its IT infrastructure. An unauthorized actor accessed and acquired files containing personal information, including names, addresses, dates of birth, and Social Security numbers of producers and policy/contract holders. The breach occurred on November 30, 2022. The company engaged forensic experts, notified the FBI and regulators, and is offering 24 months of identity protection services to affected individuals.

Clear Spring Life and Annuity Company notified South Carolina residents of a ransomware incident discovered on February 9, 2023. The breach exposed names, addresses, DOBs, SSNs, and policy numbers. The company engaged forensic investigators, notified the FBI, and is offering 24 months of identity protection services.

Clear Spring Life and Annuity Company reported a ransomware incident that was discovered on February 9, 2023. The breach, which also occurred on the same day, affected 10 Maine residents. The compromised information includes financial account numbers or credit/debit card numbers in combination with security codes, access codes, passwords, or PINs. The company offered 24 months of identity theft protection services through IDX.