LOEWS CORP

Pension Benefit Information, LLC (PBI) disclosed a data breach involving its MOVEit Transfer server exploited by an unauthorized third party on May 29-30, 2023. The incident affected 1,058 New Hampshire residents affiliated with PBI's clients. PBI patched servers, engaged in investigation, and provided 24 months of credit monitoring services to affected individuals.

Arthur J. Gallagher & Co. notified South Carolina and other state attorneys general of a ransomware incident detected on September 26, 2020. The attack occurred between June 3 and September 26, 2020, resulting in the encryption of systems and unauthorized access to certain network segments. Gallagher took systems offline, engaged forensic specialists, and notified law enforcement. The breach impacted individuals' personal information, for which 24 months of credit monitoring via Kroll was provided. Notification letters were issued starting May 24, 2021.

CNA Financial Corporation reported a ransomware attack discovered on March 21, 2021. The threat actor accessed systems starting March 5, 2021, via a fake browser update, stole credentials, and exfiltrated data to a Mega account before deploying ransomware. 205 New Hampshire residents were affected, with data including names, SSNs, and some PHI. CNA recovered the data and reported to the FBI. Notification began July 9, 2021.

CNA Financial Corporation notified Montana residents of a ransomware attack discovered on March 21, 2021. The threat actor accessed systems between March 5-21, 2021, copying limited personal information (name, SSN) before deploying ransomware. CNA recovered the data, found no evidence of misuse, and reported the incident to the FBI. Affected individuals were offered 24 months of Experian IdentityWorks.

CNA Financial Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2021-07-09. The breach occurred during 3/5/2021 - 3/21/2021. The breach was discovered on 3/21/2021. 75,349 individuals were affected. Notice was sent on 7/9/2021.

CNA Financial Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2021-03-05 and was reported on 2021-07-09. 1,958 Indiana residents were affected. 75,349 individuals affected in total.

CNA Financial Corporation suffered a sophisticated ransomware attack. The threat actor accessed systems from March 5 to March 21, 2021, copying a limited amount of data before deploying ransomware. CNA discovered the incident on March 21, 2021. Affected data included names and Social Security numbers. CNA engaged cybersecurity firms, notified the FBI, and implemented security enhancements. Complimentary identity monitoring was offered to affected individuals.

CNA Financial Corporation reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2021-07-08. 1,206 Massachusetts residents were affected. The report records the breach type as electronic.

CNA Financial Corporation (IL), a Health Plan, reported to HHS OCR on 2021-07-08 a ransomware attack affecting PHI of approximately 5,095 individuals. Breached information was located on a Network Server. PHI exposed included names, addresses, Social Security numbers, birthdates, diagnoses, lab results, and claims/treatment information. The CE notified HHS, affected individuals, media, and law enforcement. OCR provided technical assistance regarding the HIPAA Security Rule. No business associate was involved.

CNA Financial Corporation reported an external system breach (hacking) occurring between March 5, 2021, and March 21, 2021. The incident affected 75,349 individuals, including 96 Maine residents. Acquired information included names and Social Security Numbers. CNA provided 24 months of credit monitoring through Experian and a toll-free hotline.