Private Data of More Than 2.5 Million Prudential Customers Compromised in Breach

The Prudential Center and the city skyline in Boston on March 20, 2020. (Maddie Meyer/Getty Images)

Financial services company Prudential Financial recently updated the number of customers impacted in a hacking attempt earlier this year from 36,000 to more than 2.5 million.

Prudential had revealed the data breach in a Feb. 12 filing with the U.S. Securities Exchange Commission (SEC). The hack took place on Feb. 5 and the company said it received assistance from external cybersecurity experts and “immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident.”

In March, the company revealed in a filing with the Maine Attorney General that more than 36,000 customers were affected by the breach. Prudential recently updated the info on the victim count, revealing that more than 2.55 million customers were affected by the incident.

Compromised information included names and other personal identifiers as well as driver’s license and non-driver identification card numbers.

“As a part of our response to the cybersecurity incident disclosed in February, Prudential worked diligently to complete a complex analysis of the affected data and notify individuals, as appropriate, on a rolling basis starting on March 29, 2024,” a company spokesperson told The Epoch Times. “Prudential’s notifications are substantially complete at this time.”

The company takes the breach and the responsibility to safeguard personal data “seriously,” the spokesperson said. Prudential has taken “proactive measures” to boost security protocols to protect customer data.

In its notice to customers, Prudential said it was not aware of identity theft or fraud incidents related to the breach. The company offered affected customers 24 months of complimentary credit monitoring services.

“We encourage you to remain vigilant and review your account statements and free credit reports regularly to ensure there is no unauthorized or explained activity. We also encourage you to enroll in the complimentary credit monitoring services that we are offering,” the company said.

In its February SEC filing, Prudential said the breach incident did not have a material impact on the operations of the company. Year to date, Prudential shares were trading up by more than 13 percent as of early Wednesday morning.

Multiple law firms have already announced that they were looking into the breach incident. Lynch Carpenter, LLP said in a July 2 press release that affected individuals may be entitled to compensation. Strauss Borrelli PLLC, a data breach law firm, announced in April that it was investigating the breach.

Prominent Hacking Group Behind the Attack

According to a Feb. 17 post by FalconFeeds.io, a threat-intelligence platform, Prudential’s securities were compromised by the ALPHV ransomware group. Enterprise security provider Barracuda calls ALPHV “a Russian-speaking group that has a history with other Russian threat actors.”

In December, the U.S. Department of Justice (DOJ) announced a disruption campaign against ALPHV. The group has targeted more than 1,000 victims globally, including networks supporting critical U.S. infrastructure, the DOJ said.

ALPHV operates under a Ransomware as a service (RaaS) model in which a criminal group sells its ransomware code to other hackers who then carry out the attack. Victims of ALPHV have paid hundreds of millions of dollars in ransom, the DOJ stated.

The FBI developed a decryption tool that has allowed it to restore systems to more than 500 affected victims. The agency also seized several websites the group operated.

“With a decryption tool provided by the FBI to hundreds of ransomware victims worldwide, businesses and schools were able to reopen, and health care and emergency services were able to come back online,” Deputy Attorney General Lisa O. Monaco said at the time.

In a Feb. 27 update, shortly after the Prudential breach, the Cybersecurity and Infrastructure Security Agency (CISA), FBI, and the Department of Health and Human Services (HHS) issued a joint Cybersecurity Advisory on ALPHV.

Out of the 70 victims identified since December 2023, the healthcare sector was most commonly victimized by the hacking group.

“This is likely in response to the ALPHV Blackcat administrator’s post encouraging its affiliates to target hospitals after operational action against the group and its infrastructure in early December 2023,” CISA said.