PRINCIPAL FINANCIAL GROUP, INC.

Principal Financial Group notified Montana residents that on May 12, 2023, an employee inadvertently attached a customer's 2022 1099-INT form to an email sent to another client. The disclosure included name, address, truncated SSN, and account number. Principal offered one year of credit monitoring via Equifax.

Principal Financial Group notified New Hampshire residents that on or about July 6, 2021, personal information (Name, DOB, SSN) was visible on an employee's computer screen in the background of a photo posted to Facebook. The post was deleted upon discovery. The company offered one year of Equifax credit monitoring and identity theft insurance.

Principal Financial Group notified New Hampshire residents that on May 11, 2021, personal information (name, SSN) was erroneously sent to an incorrect plan sponsor. The recipient deleted the file. Principal offered one year of credit monitoring.

Principal Financial Group notified NH AG of a website coding error where customer PII (name, SSN) was inadvertently displayed to other customers. Issue occurred Nov 23-Dec 16, 2019. Discovered Jan 3, 2020 via customer reports. 14 NH residents affected. No data acquisition or misuse confirmed. Credit monitoring offered.

Moorestown Visiting Nurse Association (MVNA) notified patients of a ransomware attack on its data host, Crossroads Technologies, which occurred on November 29, 2019. Access to patient data was confirmed on March 19, 2020. Affected data included names, addresses, DOBs, SSNs, and medical records. MVNA engaged cybersecurity experts and offered one year of identity monitoring via Kroll.

Principal Financial Group notified NH AG of inadvertent disclosure of PII (names, SSNs) for 2 NH residents. Data was improperly uploaded to a public GitHub account by a contractor on Jan 9, 2018. Principal discovered the upload on July 9, 2019, during internal testing, and had GitHub delete the file on July 11, 2019. Affected individuals were offered one year of credit monitoring.

Principal Financial Group inadvertently disclosed employee PII (names, addresses, SSNs, account balances) to a former employee's personal email on March 15, 2017. Four New Hampshire residents were affected. The incident was detected by a Data Loss Prevention tool. The company requested deletion and offered one year of credit monitoring.

Principal Financial Group reported an inadvertent disclosure of PII to a third-party COBRA vendor, Chard Snyder, on Feb 3-10, 2017. Discovered March 2, 2017. Affected 4 NH residents. Data included names, SSNs, addresses, DOBs, and COBRA eligibility info. Response included individual notification, credit monitoring offer, and internal process review.

Principal Financial Group inadvertently sent a January 2017 Contribution Report containing names and Social Security numbers to an incorrect plan sponsor on February 7, 2017. The error was discovered when the recipient notified Principal. Two New Hampshire residents were affected. Principal instructed deletion, notified affected individuals, and offered one year of Equifax credit monitoring.

Principal Life Insurance Company reported that an unauthorized person used valid employer credentials to access and view the personal information (including SSN, name, age, and employment status) of two New Hampshire residents in April 2010. The incident was discovered during an investigation into fraudulent online activity. Principal engaged the employer administrator to reset credentials, added an additional access code for authentication, and offered one year of free credit monitoring to the affected individuals.