CNA Financial Corporation data breach (2021)

🐻California State AGFirst filing

Filed Jul 8, 2021bd_2498cf3d61584cfe

CNA Financial Corporation experienced a ransomware attack on its systems between March 5 and March 21, 2021. The threat actor accessed systems, copied a limited amount of personal information (names and Social Security numbers), and then deployed ransomware. CNA recovered the copied data and found no evidence of misuse. CNA notified law enforcement (FBI) and offered 24 months of credit monitoring to affected individuals.

CA 60-day late · 110d

ILHHS OCRlinked via same-victim cross-source · 100%

Filed Jul 8, 2021bd_641fa664e7fa983f

CNA Financial Corporation (IL), a Health Plan, reported to HHS OCR on 2021-07-08 a ransomware attack affecting PHI of approximately 5,095 individuals. Breached information was located on a Network Server. PHI exposed included names, addresses, Social Security numbers, birthdates, diagnoses, lab results, and claims/treatment information. The CE notified HHS, affected individuals, media, and law enforcement. OCR provided technical assistance regarding the HIPAA Security Rule. No business associate was involved.

Affected (this filing): 5,095

🌲Washington State AGlinked via multistate filing link · 100%

Filed Jul 8, 2021bd_7f8a3a5d1d0c1ff6

CNA Financial Corporation, a finance sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2021-03-21 and filed notice on 2021-07-08. 823 Washington residents were affected. 109 days elapsed between awareness and notification. 16 days to identify the breach. 0 days to contain the breach.

Affected (this filing): 823

WA AG >90d

🦬Montana State AGlinked via multistate filing link · 100%

Filed Jul 9, 2021bd_107e3f0f52c95ee9

CNA Financial Corporation reported a data breach to the Montana Attorney General. The breach was reported on 2021-07-09. The breach occurred from 3/5/2021 to 3/21/2021. 74 Montana residents were affected.

Affected (this filing): 74

🦫Oregon State AGlinked via multistate filing link · 100%

Filed Jul 9, 2021bd_8f8adf6678098d27

CNA Financial Corporation reported a data breach to the Oregon Attorney General. The breach was reported on 2021-07-09. The breach occurred during 3/5/2021 - 3/21/2021. The breach was discovered on 3/21/2021. 75,349 individuals were affected. Notice was sent on 7/9/2021.

Affected (this filing): 75,349

OR AG >45d

CNA FINANCIAL CORPORATION

Litigation Timing

Sensitive data

Affected residents by state

Timeline