GEICO Finds Employee Personal Data Exfiltrated via 2023 MOVEit Breach

  • By Steven
  • Feb 02, 2024

GEICO

The Government Employees Insurance Company (GEICO) is a privately owned insurance group with 18 branches in the US. They provide insurance plans for all aspects of life, including auto, motorcycle, travel, pet, homeowner, renter, and jewelry options. GEICO employs over 38,000 people nationwide, many of whom receive discounted prices for their insurance. GEICO also offers dental insurance to its employees through Delta Dental of California (DDC) and affiliates. DDC was one of thousands of organizations that utilized Progress Software’s MOVEit file transfer tool in 2023. As a result, over 70k GEICO employees and affiliates have had their information compromised. 

How Did the Attack Occur? 

The MOVEit breach came from a zero-day vulnerability that allowed threat actors to access the networks of organizations using the tool. Cybersecurity experts first made Progress Software aware of the vulnerability in May of 2023 and, shortly after that, announced the breach publicly. Immediately after the announcement, thousands of organizations worldwide opened investigations into their systems, including DDC. Currently, there is no public information about the assailant that accessed DDC’s MOVEit system; however, those impacted by the breach must still act to safeguard their data. 

What Information Was Viewed or Stolen? 

The information stolen in this event is confidential; further, the public breach filing for the incident—published by the Maine Attorney General—offers little detail about the compromised data elements. The filing lists individuals’ stolen driver’s licenses or government-issued ID numbers, but the event likely exposed more. The Maine Attorney General’s Office also publishes sample consumer notices associated with these filings; however, the notice published with this filing is the same as the one published for DDC. Consequently, there are no other indications of breached data elements despite signs that additional elements are compromised.

How Did GEICO Corporation Admit to the Breach? 

Progress Software announced the MOVEit breach at the end of May 2023. According to the DDC’s investigation, the assailants accessed the related GEICO file system around this time, between May 27th and May 30th. Around June 1st, DDC was alerted to the MOVEit event and opened an investigation into their systems. Over a month later, around July 6th, DDC confirmed that the assailants accessed and removed files from their MOVEit server. DDC officials eventually notified GEICO of their breach around December 22nd. GEICO immediately notified the proper parties, including sending impact notices around January 29th, 2024.

What Will Become of the Stolen Information? 

Predicting what will happen to the compromised information from this breach is challenging. The difficulties come from a lack of details; the public doesn’t know what information the event compromised (besides IDs), so we cannot predict how the faceless assailants may use it. However, the DDC’s sample notice—published with the GEICO filing—suggests that impacted parties consider identity, account and financial monitoring services. These resources may indicate the threats that victims now face due to the event, which means that the threat actors may have accessed more information than ID numbers.

What Should Affected Parties Do in the Aftermath of the Breach? 

Victims of this breach have a choice; they can wait until their physical notices arrive with a list of impacted data elements or act before the notice arrives. At a minimum, victims must secure their accounts. Strong, unique passwords, especially those generated by password managers, are necessary for all accounts. Those profiles should also receive increased security options, including multi-factor authentications and one-use tokens whenever possible. Moreover, the MOVEit event happened months ago, but victims can still take action to protect themselves, with or without a physical notice.

About the Author
IDStrong Logo

Related Articles

Instagram Vulnerability Allowed Hackers Access to Control Your Phone

Security experts Check Point Research discovered a critical vulnerability while examining Instagra ... Read More

Alien Malware Infects More than 226 Mobile Apps and Steals Bank Data

As reported on September 24, 2020, by ZDNet and ThreatPost, a new strain of malware named “A ... Read More

Universal Health Systems Hit by Ransomware Attack

Universal Health Systems (UHS), a Fortune 500 company owning more than 400 hospitals across the co ... Read More

Exchange Server Bug Exposes a Big Risk to Hackers

Months after Microsoft released a patch to fix a serious flaw in MS Exchange Server, more than 61% ... Read More

Clients’ Bank Data Exposed in Blackbaud Ransomware Attack

Blackbaud software was victim to a ransomware attack last May, and new information suggests that c ... Read More

Latest Articles

Cementitious Vendor—CGM—Network Compromised by 315k Data Breach

Cementitious Vendor—CGM—Network Compromised by 315k Data Breach

Based in Philadelphia, Pennsylvania, CGM is a nationwide cementitious vendor for industries and construction projects. They are a leader in manufacturing, labeling, and distributing custom cement and patching products.

Chattanooga Heart Institute Updates on 2023 Network Cyber Attack

Chattanooga Heart Institute Updates on 2023 Network Cyber Attack

Patients with cardiovascular issues may appear in one of the Chattanooga Heart Institute (CHI) facilities in Tennessee and Georgia.

Oklahoma’s Largest Non-Profit Health System Breached; 2.3 Million Exposures

Oklahoma’s Largest Non-Profit Health System Breached; 2.3 Million Exposures

INTEGRIS Health is the largest non-profit healthcare network in Oklahoma and surrounding regions. The network includes medical and surgical centers, hospitals, emergency rooms, hospice options, addiction recovery programs, and a holistic approach to health and wellness.

Featured Articles

How to Buy a House with Bad Credit

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.

Free Identity Exposure Scan
Instantly and Securely Check if Your Personal Information is Exposed on the Dark Web or Sold by Data Brokers
Please enter first name
Please enter last name
Please select a state
Close
Free Identity Threat Scan
Instantly Check if Your Personal Information is Exposed
All fields below are required
Please enter first name
Please enter last name
Please enter a city
Please select a state
Please enter an age
Please enter an email address
Close