Back-Office Servicer Says Dual Hacks in 2024 Hit 1.6 Million

Landmark Admin, a third-party vendor that provides back-office administrative services to life insurance and annuity companies, said 1.6 million people and more than a dozen clients could be affected by back-to-back 2024 data exfiltration incidents. The hacks compromised a wide range of personal, financial and health information.

See Also: Top 10 Technical Predictions for 2025

The Texas-based firm in its latest breach report said the incident began with an initial unauthorized access by threat actors into its systems in May 2024.

Then, a few weeks later, hackers returned through “a backdoor on a third-party backup appliance within Landmark’s environment,” Landmark said. The Landmark environment itself “was designed with a Linux-based architecture that is hardened against cyberthreats,”

Both incidents resulted in data exfiltration.

Hack Details

Landmark initially detected suspicious activity on its network on May 13, 2024 – and then on May 15, 2024 the company discovered that data has been exfiltrated.

On May 16, Landmark recovered all data that had been exfiltrated, the company said. The firm does not indicate how it “recovered” its exfiltrated data, and whether it paid a ransom to an attacker.

“On or about May 22, 2024, the third-party cybersecurity firm determined that the root cause and initial unauthorized access to Landmark’s system had occurred on May 13, 2024, via the VPN using valid credentials based on the available artifacts and live forensics,” Landmark said.

The forensic investigation could not determine how the credentials were compromised, Landmark said. The response included remediation, recovery, live forensics and a comprehensive forensic investigation to determine the nature and scope of the incident, the breach notice said.

“The third-party cybersecurity firm also concluded the root cause and attack vector had been mitigated and no longer existed after Landmark changed the account passcodes, and Landmark’s environment was safe and secure and free of any malicious activity,” Landmark said.

“Accordingly, Landmark fully reinstated its network and remote access.”

But then, on June 17, 2024, Landmark discovered the threat actor had re-entered its environment and exfiltrated data.

“Although the investigation found data had been exfiltrated, it was unable to identify which specific files or folders were exfiltrated after the threat actor re-entered Landmark’s systems,” Landmark said.

The company said “a significant amount” of Landmark’s data contains no personally identifiable information, so “it is possible that the exfiltrated data did not contain any personally identifiable information. Landmark has no evidence that any of the exfiltrated data actually contained personally identifiable information.”

Rising Victim Tally

Data potentially compromised in the incident includes a mix of personal, financial, medical and other information that varies among individuals.

That includes name; address; Social Security number; date of birth; tax identification number; images of driver’s license number and state-issued identification cards; passport number; financial account number; bank account and routing number.

Also potentially compromised was individuals’ medical information; health insurance policy number; life and annuity policy information; life insurance policy application; and insurance benefit payment amount and payees.

Landmark first reported the hack to state regulators, including Maine’s attorney general, in June 2024, but has since filed multiple updated reports with the number of individuals affected subsequently climbing.

The company’s most recent report filed to Maine’s attorney general on April 11 indicated that the individual breach victim count has nearly doubled to 1.6 million, up from 806,519 reported in October 2024, the company’s last previous filing.

Insurance carriers affected by the incident, for which Landmark acted as a third-party administer, include: Pan-American Life Insurance Co., TruSpire Retirement Insurance Co., Continental Life Insurance Co. of Brentwood Tennessee, Accendo Insurance Co., Tier One Insurance Co. and American Home Life Insurance Co.

Also affected were Liberty Bankers Insurance Group and several affiliated companies including American Monumental Life Insurance Co., Pellerin Life Insurance Co., American Benefit Life Insurance Co., Liberty Bankers Life Insurance Co., Continental Mutual Insurance Co. and Capital Life Insurance Co.

Security Enhancements

Landmark in its breach notice detailed steps the company has taken to bolster its data security since the attack to help prevent similar future incidents.

“Specifically, Landmark acquired servers and after server hardening, deployed a new firewall with the latest firmware, obtained new external IP address assigned by a new Internet Service Provider.”

The company said it also “implemented new domain controllers with new account naming conventions and forced new passwords, enabled BitLocker on all hard drives, reimaged all printers on the network, reimaged all network switches and updated to the latest firmware and reimaged and updated all IoT devices with the latest firmware.”

Landmark has also provided additional security training to all staff, restricted all points of access to its systems, engaged a managed service provider to for additional monitoring and protection software, the breach notice said. Landmark also requires multi-factor authentication for all devices “for both user and administrator logins.”

Landmark reported the incident to law enforcement, but added that its breach notification to individuals “has not been delayed due to any law enforcement investigation,” the company said.

After the June 17 attack, “Landmark never reinstated access to the impacted system for its operations and, instead, built a new system that was totally disconnected from the prior system. The third-party cybersecurity firm set up surveillance and Landmark’s IT vendor monitored on the new system from its inception to ensure there was no malicious activity,” the breach notice said.

An attorney representing Landmark in its breach reports to state regulators did not immediately respond to Information Security Media Group’s request for additional details about the back-to-back incidents, including whether Landmark paid its attackers a ransom.

Landmark faces consolidated proposed class action litigation in a Texas federal court involving the hacking episode.

That consolidated litigation, which includes about a dozen federal lawsuits, alleges a list of failures by Landmark, including negligence to safeguard sensitive personally identifiable information in the company’s possession, custody and control.

The litigation seeks relief including financial damages and an injunctive order for Landmark to improve its data security practices “to reasonably guard against future breaches.”