2023-06-22 GENWORTH FINANCIAL INC Cybersecurity Incident

Page last updated on April 11, 2024

GENWORTH FINANCIAL INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2023-06-22 16:15:59 EDT.

Incident Details

Material: Unknown
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date:
Detected Date:
Disclosure Date: 2023-06-22
Contained Date:
Recovered Date:

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2023-06-22

GENWORTH FINANCIAL INC filed an 8-K at 2023-06-22 16:15:59 EDT
Accession Number: 0001193125-23-172549

Item 8.01 Other Events.

Genworth Financial, Inc. (the “Company”) has been notified by PBI Research Services (“PBI”), a third-party vendor to the Company, that PBI, in common with numerous other organizations and governmental agencies, was subject to the widely reported security events involving the MOVEit file transfer system, which PBI uses in the performance of its services. The MOVEit file transfer system security event resulted in the unauthorized acquisition by a third-party of data from several organizations and governmental agencies, including Company data. As further described below, the Company believes that the personal information of a significant number of insurance policyholders or other customers of its life insurance businesses was unlawfully accessed, and is working to ensure that protection services are provided to those impacted individuals. The Company believes that the PBI security event has not had any impact on any of the Company’s information systems, including its financial systems, and that there has not been any material interruption of the Company’s business operations. The Company’s Enact mortgage insurance business was not affected by the incident. While the Company is continuing to measure the impact, including certain remediation expenses and other potential liabilities, the Company does not currently believe this incident will have a material adverse effect on its business, operations, or financial results.

PBI is a third-party vendor that provides services to various companies in the insurance industry. The Company’s life insurance businesses use PBI to, among other things, satisfy applicable regulatory obligations to search various databases to identify the deaths of insured persons under life insurance policies, and to identify the deaths of insured persons under long-term care insurance, and annuity policies which can impact premium payment obligations and benefit eligibility. For life insurance policies and annuity contracts, this helps identify the possible eligibility of beneficiaries for death benefits even prior to the submission of claims, or for policies that beneficiaries may not know exist.

Since receiving notification of the security event, the Company, together with PBI, promptly launched an investigation to determine to what extent personal information had been unlawfully accessed by the threat actor. While that investigation is still ongoing, it is the Company’s understanding, based on the current state of the investigation that approximately 2.5-2.7 million policyholders’ or other customers’ personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the PBI security event.

The Company will ensure that appropriate notification is provided to individuals affected by this security event, as well as to regulatory agencies as required by federal and state law. In addition, impacted individuals will be offered credit monitoring and identity theft protection services. Additional information and contact information can be found at www.genworth.com/moveit.

With respect to any impact on the Company, the Company does not itself use the MOVEit file transfer system, and PBI has informed the Company that it has rectified the vulnerability that allowed the incident.

Company Information