Kelly Benefits says 2024 data breach impacts 550,000 customers
Kelly & Associates Insurance Group (dba Kelly Benefits) is informing more than half a million people of a data breach that compromised their personal information.
The Maryland-based health and life insurance agency has issued an update on a security incident it suffered last year between December 12-17, when unauthorized actors breached its IT systems and stole files.
On April 9, 2025, the company stated that the incident impacted 32,234 individuals. The figure was revised multiple times until the final tally shared with authorities in the U.S. counted 553,660 individuals.
Kelly Benefits is a provider of benefits consulting, enrollment technology, payroll administration, HRIS, compliance support, and carrier management.
As multiple organizations across the country contract the firm's services, determining the scope of the data breach and the exact number of impacted people was a complicated task.
The organization’s latest update lists a total of 46 entities impacted by the data breach, including healthcare giants like:
- United Healthcare
- Aetna Life Insurance Company (CVS Health)
- CareFirst BlueCross BlueShield
- Humana Insurance ACE
- The Guardian Life Insurance Company of America
- Mutual of Omaha Insurance Company
- OneAmerica Financial Partners, Inc.
The data breach notice sent to impacted individuals yesterday informs recipients of the specific data types impacted by the breach, which vary per person.
However, the general notice published on the site says that the compromised info may contain full names, Social Security number, tax ID number, date of birth, medical information, health insurance information, and financial account information.
Exposure of this information puts people at risk, as they can become victims of phishing attacks, social engineering, and scams. Impacted individuals are advised to exercise increased vigilance against unsolicited communications.
To mitigate the risk, Kelly Benefits offers all letter recipients 12-month free of charge credit monitoring and identity theft protection services through IDX identity theft protection.
Potentially impacted individuals are also advised to consider placing a security freeze on their credit report and closely monitor their accounts for suspicious activity.
TA829 and UNK_GreenSec Share Tactics and Infrastructure in Ongoing Malware Campaigns
Aeza Group sanctioned for hosting ransomware, infostealer servers
Free online web security scanner
