Insurance Group Says Only Public Data Stolen in Recent Breach

The National Association of Insurance Commissioners has announced that a group calling itself ShinyHunters breached its computer systems by exploiting a security flaw in Oracle PeopleSoft software. According to the organization, the attackers only stole publicly available data, outdated system logs, and configuration files. The breach happened when attackers found and used a previously unknown vulnerability, called a zero-day (a newly discovered software flaw with no fix yet) flaw, in the software.

If you have insurance or work in the insurance industry, you may wonder if your personal information was affected. The NAIC states that the stolen data was already publicly available and did not include sensitive personal information. However, it is always wise to stay alert after any breach announcement involving an organization that might have your information.

Even though the NAIC says sensitive data was not stolen, you should still take these precautions:

1. Watch your insurance accounts and statements for any unusual activity or changes you did not authorize.
2. Be extra cautious about emails or phone calls claiming to be from insurance companies, especially if they ask for personal information or payment.
3. If you work in the insurance industry and use systems connected to NAIC, check with your employer about whether you need to change any passwords or take additional security steps. To protect yourself after any data breach announcement, remember that scammers often use news of breaches to trick people. They may send fake emails pretending to be from the affected organization, asking you to click links or provide information. Always go directly to a company's official website by typing the address yourself rather than clicking email links. Keep your computer and phone software updated, as these updates often include security fixes. Consider using two-factor authentication on all important accounts, which adds an extra layer of protection even if someone gets your password.