Kelly Benefits Hack Victim Count Jumps Significantly, Again

The count of individuals affected by a hack discovered in December 2024 by Maryland-based Kelly & Associates Insurance Group continues to climb with a new total of 413,032 – up by nearly 150,000 since the company updated its breach disclosure last month. The list of clients affected has also grown.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

Kelly & Associates, which operates as Kelly Benefits, hinted in a Friday regulatory filing that the numbers and details about the breach could continue to change.

“This notice may be further supplemented if significant new facts are learned subsequent to its submission,” Kelly said.

Kelly Benefits submitted an updated list of clients affected. The list adds about a dozen more clients to the previous tally of nine companies.

Among the additional clients listed are Aetna Life Insurance Co., Fidelity Building Services Group, Humana Insurance, Nutramax Laboratories, Reliance Standard Life Insurance, United Healthcare Services and Virtua Health.

Kelly Benefits did not immediately respond to Information Security Media Group’s request for comment on the additional clients and number of individuals affected by the hack.

The company’s tally of victims has gone up considerably since its initial disclosure on April 9 of only 32,234 individuals.

The company upped the figure to 263,893 in a supplemental report filed on April 21, before the latest tally jumped again by another 60% in its latest report on May 2 (see: Kelly Benefits Notifying Nearly 264,000 Data Theft Hack).

In its breach notice, Kelly Benefits said it learned of suspicious activity within its environment. The benefits company did not specify when it discovered the suspicious activity.

An investigation determined the company’s IT environment was subject to unauthorized access between Dec. 12 and Dec. 17, 2024. During that time, certain files were copied and taken by the attackers, the company said.

Information compromised in the incident varies among individuals but potentially includes name, Social Security number, date of birth, medical information, health insurance information and financial account information.

The tally of breach victims is not the only thing climbing in the Kelly Benefits hack. So is the number of proposed federal class action lawsuits filed against the company. The firm now faces at least 13 such lawsuits.

Kelly Benefits is among a growing list of third-party firms reporting significant health data breaches this year. As of Tuesday, nearly 40% of the individuals affected in 2025 so far by major health data breaches appearing on a federal reporting website were victims of business associate incidents.

Healthcare is especially vulnerable to significant third-party breaches. The latest Verizon Data Breach Investigations Report found that 30% of breaches across all sectors were linked to third-party involvement, twice as much as last year (see: Third-Party Data Breaches Are on the Rise).

“Kelly Benefits is a unique HIPAA business associate because it provides third-party administrator services,” said regulatory attorney Paul Hales of the Hales Law Group.

Third-party administrators connect employer-sponsored health plans with employees and health insurance companies. They “transmit, receive, create and maintain PHI continuously to perform services for health plans of all sizes and for countless individuals,” he said.

“TPAs are particularly at risk because they communicate with so many parties, any one of which could unknowingly open the door for a hacker simply because someone opened a phishing email,” he said.

Networks of individuals and HIPAA-regulated entities sharing PHI can be enormous, and the sophistication of their technology is uneven, making it difficult to determine quickly who was affected by a breach, he said.