Fidelity Investments Life Insurance notified 28,000 after Infosys McCamish breach

Fidelity Investments Life Insurance Company began notifying customers in March 2024 that their personal information had likely been taken in an intrusion at Infosys McCamish Systems, a third-party administrator it used to service life insurance policies. Infosys McCamish is a subsidiary of Infosys BPM, itself owned by Infosys.

According to the notification letter filed with state regulators, Infosys McCamish told the insurer in early November 2023 that it had suffered a cybersecurity event that disrupted the services it provided. A forensic firm retained by the vendor later established that an unauthorized third party had reached certain systems between October 29 and November 2, 2023 and obtained data stored on them.

The insurer said the information likely acquired included names, Social Security numbers, state of residence, date of birth and, for customers who had supplied them to make premium payments, bank account and routing numbers. It stressed that no Fidelity network or system was involved, and that the vendor was still unable to determine with certainty what had been accessed. Filings and press accounts put the number of people notified at roughly 28,000, across Fidelity Investments Life Insurance Company and Empire Fidelity Investments Life Insurance Company.

Fidelity offered 24 months of credit monitoring and identity restoration through TransUnion Interactive. The same Infosys McCamish intrusion affected other clients, most prominently Bank of America, which notified about 57,000 deferred compensation plan participants.