LockBit Ransomware Breach at Infosys McCamish Affects Over 6 Million People, Not 57,000

 

LockBit Ransomware Breach at Infosys McCamish Affects Over 6 Million People, Not 57,000
Image credit: teiss website 

When LockBit ransomware affiliates attacked Infosys McCamish Systems (IMS) in late 2023, it was initially believed that sensitive information on about 57,000 people had been stolen. However, a new report shared with US authorities revealed that the breach actually impacted more than six million individuals.

IMS, with the help of third-party eDiscovery experts and outside counsel, conducted a thorough review to identify the personal information accessed and to determine the affected individuals. The company has since notified the impacted organizations and individuals about the compromise of their personal data.

The stolen data varied among individuals but generally included Social Security Numbers (SSN), birth dates, medical information, biometric data, email addresses, passwords, Driver’s License numbers, state ID numbers, financial account information, payment card information, passport numbers, Tribal ID numbers, and US military ID numbers. This extensive information could potentially be used for devastating phishing or identity theft attacks.

To mitigate the threat, IMS provided affected individuals with free identity protection and credit monitoring services through Kroll for two years. 

In November 2023, Bank of America filed a data breach report with the Office of the Maine Attorney General, indicating that the incident originated from an Infosys subsidiary. The report, filed by an outside attorney on behalf of Bank of America, identified IMS as the affected entity. Initially, it was believed that the breach involved around 57,000 people, with hackers stealing names and SSNs. The incident, which occurred on October 29, 2023, was described as an "external system breach (hacking)."

IMS did not specify which companies were affected by the breach, other than Oceanview Life and Annuity Company.