Liberty Mutual Faces Lawsuit Over Ransomware Attack Exposing Sensitive Customer Data A proposed class-action lawsuit accuses Liberty Mutual Insurance Co. of failing to protect customer data following a ransomware attack linked to the cybercriminal group Everest. The breach, which occurred on April 30, allegedly exposed personally identifiable information (PII) and protected health data, including Social Security numbers, financial records, and medical information. The Everest ransomware group claimed responsibility for the attack, posting Liberty Mutual’s name and logo on its dark web leak site and threatening to publish stolen records after ransom negotiations expired. Plaintiffs allege the insurer did not notify affected customers directly, leaving them unaware of their heightened risk of fraud and identity theft. The lawsuit, filed on May 6 in the District of Massachusetts Eastern Division, names two Massachusetts residents Robert Francis and John Goodwin as lead plaintiffs. Francis reported receiving spam, scam, and phishing messages after the breach, forcing him to spend significant time monitoring his accounts. Goodwin experienced anxiety, sleep disruption, and emotional distress due to the exposure of his sensitive data. Plaintiffs argue that Liberty Mutual failed to implement adequate cybersecurity measures, including proper encryption, and violated its own privacy policies. The complaint also warns that stolen data may already be circulating on the dark web, increasing long-term risks for affected individuals. The lawsuit seeks damages and injunctive relief for a proposed nationwide class of victims. Liberty Mutual has not responded to requests for comment.

The California Office of the Attorney General reported a data breach involving Liberty Mutual Group, Inc. on March 30, 2021. The breach occurred between November 21, 2020, and March 12, 2021, during which an unauthorized third party may have accessed individuals' driver’s license numbers and personal information via fraudulent auto insurance applications. The exact number of individuals affected remains unknown.