Beacon Mutual Insurance Hit by Ransomware Attack, Hacker Group INC Claims Responsibility Beacon Mutual Insurance Company, Rhode Island’s leading provider of workers’ compensation insurance and the state’s designated "insurer of last resort," confirmed a ransomware attack on January 14. The Warwick-based company disclosed the incident on January 25 after its appearance on public ransomware tracking sites prompted inquiries. According to Michelle N. Pelletier, Beacon’s assistant vice president of marketing and communications, the attack did not encrypt the company’s production environment, allowing normal operations to resume by January 20. However, select systems were proactively disconnected to contain the threat, and a forensic investigation conducted with external experts is ongoing to assess potential data exposure. Affected individuals will be notified if their personal information was compromised. The hacker group INC Ransom claimed responsibility for the breach, posting on its dark web leak site that it exfiltrated 275 GB of sensitive data, including internal documents, financial reports, employee and claimant personal information (such as Social Security numbers), client databases, and system backups. Cybersecurity researcher Connor Goodwolf confirmed the ransom page remains active, though it lacks a countdown timer for public data release. INC Ransom, which operates as a ransomware-as-a-service (RaaS) group, has targeted high-profile victims in 2025, including the Pennsylvania Attorney General’s office and Stark Aerospace, a U.S. Department of Defense contractor. The group employs double extortion, encrypting files while also stealing data to pressure victims into paying ransoms. A November 2025 report from cybersecurity firm Blackpoint Cyber noted INC’s rapid growth, with 300 claimed victims in 2025 nearly double its 2024 total attributed to its adaptive tactics, including partial encryption and multithreading for faster attacks. Beacon Mutual, a mutual insurance company owned by its policyholders, plays a critical role in Rhode Island’s workers’ compensation system. Established in 1990 as the State Compensation Insurance Fund to stabilize the market after private insurers withdrew, it rebranded as Beacon in 1992 and later expanded into Massachusetts and Connecticut. The state spent over $23 million on Beacon’s services in fiscal year 2025, per Rhode Island’s transparency portal. While law enforcement has been notified, details of the attack remain limited as the investigation continues. A Washington, D.C.-based law firm, Mason LLP, has begun exploring a class action lawsuit on behalf of potential breach victims.

Beacon Mutual Insurance Company Hit by Data Breach, Exposing Sensitive Personal Information On January 14, 2026, Beacon Mutual Insurance Company a Rhode Island-based workers' compensation insurer detected unauthorized activity on its computer network. An investigation revealed that an unknown actor accessed and exfiltrated certain files between January 7 and 14, 2026. The breach exposed sensitive personal data, including names and Social Security numbers, putting affected individuals at heightened risk of identity theft and fraud. Those who received a data breach notification from Beacon Mutual may have been impacted. National class action law firm Edelson Lechtzin LLP has launched an investigation into the incident, evaluating potential legal claims on behalf of affected individuals. The firm is offering free case evaluations to determine eligibility for pursuing remedies related to the breach. Beacon Mutual Insurance Company, headquartered in Warwick, Rhode Island, specializes in workers' compensation and workplace safety coverage. The incident underscores ongoing cybersecurity risks in the insurance sector, particularly for organizations handling sensitive personal data.

Back-office services provider Conduent disclosed a cyberattack in January 2025 that exposed data of 10.5 million individuals, primarily from healthcare insurance clients like Blue Cross Blue Shield of Montana (462,000 members affected). The breach, active from October 21, 2024, to January 13, 2025, involved unauthorized access to a 'limited portion' of its IT environment, with attackers exfiltrating files tied to multiple clients. Financial fallout includes $50 million spent ($25M on incident response, $25M on breach notifications), alongside 12 class-action lawsuits, regulatory investigations (e.g., Montana), and warnings of potential litigation, reputational harm, and regulatory penalties. The company admitted the attack could adversely impact its financial condition, with ongoing risks from data theft, legal actions, and operational disruptions. No ransomware was confirmed, but the scale of exposed personal and health data suggests severe long-term consequences for affected individuals and partner organizations.