Information on third-party vendor security incident

On June 16, 2023, Corebridge Financial was made aware by a former third-party vendor, Pension Benefit Information, LLC (PBI), that they were impacted by the MOVEit file transfer vulnerability that had affected a large number of organizations globally. On June 26, 2023, the vendor confirmed that Corebridge customer data in their possession was obtained by an unauthorized party due to the exploitation of that software vulnerability. 

MOVEit Transfer is a managed file transfer software solution that allows an organization to securely transfer large amounts of data efficiently between parties. In addition to PBI, many organizations, including private companies, government agencies and financial and educational institutions, were affected by this vulnerability.

PBI was a third-party vendor Corebridge previously utilized for regulatory compliance and operational support services for our businesses. Like many other insurance and financial services companies, we used PBI’s services to identify otherwise unreported deceased end consumers of our products and services to meet our obligations. Corebridge no longer uses PBI’s services.

Along with PBI and their forensic investigators, we conducted a thorough investigation to determine the scope and nature of personal information involved. Our investigation determined that the incident impacted personal information of (1) Corebridge policyholders and account owners such as name, address, date of birth, policy/account number, and Social Security number, and (2) beneficiaries such as name, address, and date of birth. 

Corebridge’s information systems and operations were not impacted, and we continue to serve our customers as we always have.

We take the privacy of our customers’ data very seriously and undertook additional measures to secure our operations and to protect our customers’ data, which include enhanced fraud monitoring. Corebridge’s own systems and data were not affected by the MOVEit vulnerability or PBI’s related incident, and we successfully patched our instances of the MOVEit application in accordance with the latest best practices.

In 2023 following the PBI security incident, letters were mailed from PBI and Corebridge to individual policy/contract owners whose personal information was impacted in 2023. The letter offered individuals 24 months of complimentary credit monitoring, fraud consultation and identity restoration services as an added measure of assurance. The notification letter provided information on how to register for these free services and a toll-free number individuals could call with any questions.

It is always advisable to review your account statements and credit reports regularly for any unauthorized activity. You should immediately report any unusual activity to your financial institution. You can also contact the three major credit bureaus to place a “fraud alert” on your file at no cost, which alerts creditors to contact you before they open a new credit account under your Social Security number.