One of America’s biggest benefits administration specialists has revealed that more than half a million individuals have been impacted by a 2024 data breach at the company.
Kelly Benefits describes itself as “one of the nation’s largest and fastest-growing providers of benefits administration and technology, broker and consulting services, payroll solutions and comprehensive tools and strategies to benefit businesses of all sizes.”
As such, it counts some of America’s biggest healthcare providers, insurers and financial services firms as clients, among other businesses. Those impacted by the breach include UnitedHealthcare, The Guardian Life Insurance Company of America, CVS Health and OneAmerica Financial Partners.
Kelly Benefits – which trades as Kelly & Associates Insurance Group – revealed on Monday that 553,660 individuals were impacted by the incident.
Read more on data breaches: US Data Breach Victim Count Surges 26% Annually
A data breach notification posted online by the Office of the Maine Attorney General claimed that the breach stemmed from unauthorized access to the Kelly Benefits IT environment between December 12 and 17 2024, when “certain files were copied and taken.”
It added, “We then began a time-intensive and detailed review of all files affected by this event to determine what information was present in the impacted files and to whom it related.”
Complexity Slows Response
This incident response process and investigation was made more complex by the sheer number of client organizations involved. Kelly Benefits listed 45 that were affected by the breach in a statement on its website.
“Kelly Benefits reviewed its internal records to match the individual to the appropriate client or carrier. This analysis was completed on March 3, 2025. Kelly Benefits then provided notice to carriers and clients and offered to provide notice on their behalf,” it explained.
“While the specific data elements vary for each potentially affected individual, the scope of information potentially involved includes an individual’s name and one or more of Social Security number, tax ID number, date of birth, medical information, health insurance information, and financial account information.”
That information could be highly monetizable by threat actors – either to make phishing campaigns more convincing or to use directly in identity fraud attempts.
That partly explains why Kelly Benefits is offering some victims access to free credit monitoring and identity protection services. It also encouraged affected individuals to consider placing a credit freeze on their credit reports and/or a one-year fraud alert.
No tags.
