American National Insurance Company Facing Class Action Over May 2023 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges negligence on the part of American National Insurance Company is to blame for a May 2023 data breach that exposed the personal information of current and former customers.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

In an August 2023 notice letter sent to victims, American National Group, LLC—which does business as American National Insurance Company—announced that it had been impacted by a cyberattack involving MOVEit, a file transfer platform owned by third-party IT vendor Progress Software Corporation. The notice relayed that on May 28, an unauthorized actor gained access to the insurance company’s files by way of a vulnerability in the MOVEit software and, as a result, compromised the private data of American National customers.

The 56-page lawsuit shares that the sensitive information exposed in the breach included full names, dates of birth, addresses, Social Security numbers, health insurance data and medical information such as treatment dates and provider details.

The suit alleges that the Texas-based insurance company failed to implement reasonable data security practices to safeguard customer information and neglected to ensure its IT vendor maintained sufficient cybersecurity protocols as well.

Moreover, the notice letter sent to affected customers lacked important details about the incident, the case claims. Per the complaint, the notice did not explain the “root cause” of the breach, the dates of American National’s investigation, how cybercriminals gained access to the system or what steps are being taken to prevent the disclosure of sensitive information in the future.

Without these “critical facts,” a victim’s ability to mitigate the harms associated with the unauthorized exposure of their data is “severely diminished,” the filing says.

According to the notice letter, American National is offering victims 24 months of complimentary identity monitoring services. However, the case charges that this gesture is “wholly inadequate” in light of the risks of fraud and identity theft that victims now face for the rest of their lives.

The lawsuit looks to represent anyone in the United States whose personal information was affected as a result of the American National data breach in 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.