Keenan & Associates breach exposed data of more than 1.5 million people

Keenan & Associates, a Torrance, California insurance brokerage that administers employee benefits, workers' compensation and property and liability programs for public agencies and school districts, began notifying more than 1.5 million people in late January 2024 that their personal data had been stolen.

According to the company's notification, intruders had access to parts of its network between August 21 and August 27, 2023. Keenan said it detected a disruption on one of its servers on August 27, contained the activity within hours, and brought in outside forensic specialists and the FBI.

The stolen files contained names alongside one or more of the following: date of birth, Social Security number, driver's license number, passport number, health insurance information and general health information. A filing with the Maine attorney general put the total at 1,509,616 individuals. Prime Healthcare later confirmed that 101,135 members of its employee health plan were among those affected.

Keenan said it was unaware of any actual or attempted misuse of the stolen data and offered affected individuals two years of complimentary credit monitoring and identity theft protection. The company said it had strengthened the security of its network and had seen no further unauthorized activity since the intrusion. It did not say publicly whether ransomware was deployed, and no ransomware group was named in either outlet's reporting.