Kelly Benefits Notifying Nearly 264,000 of Data Theft Hack

A Maryland-based outsourced benefits and payroll manager is notifying nine large clients and nearly 264,000 individuals that their sensitive personal information was potentially compromised in a December hack.

The tally of affected people has shot up eight-fold since Kelly & Associates Insurance Group, which operates as Kelly Benefits, earlier this month published an estimate of the hack’s scope.

The company’s current tally of 263,893 affected individuals is up substantially from the 32,234 originally reported on April 9 to state regulators, as well as to the U.S. Department of Health and Human Services as a HIPAA breach.

The benefits company said it is providing breach notices to affected individuals on behalf of nine clients: Amergis, Beam Benefits, Beltway Companies, CareFirst BlueCross BlueShield, Guardian Life Insurance Co., Intercon Truck of Baltimore, Publishers Circulation Fulfilment, Quantum Real Estate Management and Transforming Lives.

Kelly Benefits in a statement declined comment, citing “the sensitive nature of the incident and subsequent investigation.”

An investigation into the incident determined the company’s IT environment was subject to unauthorized access between Dec. 12 and Dec. 17, 2024. During that time, certain files were copied and taken by the attackers, the company said.

“Kelly Benefits then began a time-intensive and detailed review of all files affected by this event to determine what information was present in the impacted files and to whom it related,” the company said. It analyzed internal records to match the individual to the appropriate client or carrier.

Information compromised in the incident varies among individuals but potentially includes name, Social Security number, date of birth, medical information, health insurance information and financial account information.

Kelly Benefits notified the FBI about the incident. The company said it is also continuing to review its security policies, procedures and tools.

As of Wednesday, at least one proposed federal class action lawsuit had been filed against Kelly Benefits involving the hacking incident.

That lawsuit alleges that Kelly Benefits was negligent in failing to protect sensitive personally identifiable information from access by unauthorized parties.

“Even with several months of credit monitoring services, the risk of identity theft and unauthorized use of plaintiff’s and class members’ PII is still substantially high,” the lawsuit asserts.

“Cybercriminals need not harvest a person’s Social Security number or financial account information in order to commit identity fraud or misuse plaintiffs and the class’s PII,” the lawsuit adds. “Cybercriminals can cross-reference the data stolen from the data breach and combine with other sources to create ‘Fullz’ packages, which can then be used to commit fraudulent account activity on plaintiff and the class’s financial accounts.”