Genworth genworth.com Genworth data breach 2020: what happened and what to do
On April 20, 2020, Genworth found that a few online accounts used by insurance agents had been accessed with stolen login credentials. Documents with names, addresses, birth dates, phone numbers, agent codes, Social Security numbers and signatures were viewable.
View all 13,177 breaches- Breach date
- 20 Apr 2020
- Made public
- 10 Jun 2020
- Data exposed
- Names, Physical addresses, Dates of birth, Phone numbers, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
This page covers a 2020 incident at Genworth involving insurance agent accounts. It is separate from any later Genworth incident.
What happened
On April 20, 2020, Genworth identified unauthorized access to a select few online producer accounts. Producers are the insurance agents who sell Genworth policies. Genworth said the access happened because login credentials had been compromised, and its investigation indicated the credentials were stolen from another site. In other words, the logins were reused or exposed elsewhere and then tried on Genworth's portal.
Sources checked: oag.ca.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
The accessed documents contained the agent's name, address, date of birth, telephone number, agent code, Social Security number and signature. Genworth also said some of the agents' clients may have been affected and would be notified separately. The notice does not give a total number of people affected.
What Genworth did
Genworth disabled the affected producer accounts, kept monitoring them, and said it found no evidence of further unauthorized activity. It contacted federal authorities and offered affected agents one year of credit monitoring and identity resolution services through ID Experts. The sample letter filed with the California Attorney General is dated May 14, 2020.
What it means for you
A Social Security number with a name and date of birth is enough to open credit in someone else's name. If you are an insurance agent who got this letter, or a client told your information was involved, the risk is identity theft rather than a one-off card fraud. The reuse of passwords across sites is also what made this breach possible, which is worth checking in your own accounts.
What to do if you were in it
- 1
Freeze your credit
A credit freeze stops new accounts being opened in your name and is free. Place one with Equifax, Experian and TransUnion. The FTC explains how: https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts
- 2
Take the credit monitoring offer
If your letter came with the ID Experts offer, check the enrollment instructions in it. Even if you decline, watch your credit reports for accounts you don't recognize.
- 3
Change reused passwords
Genworth said the logins were stolen from another site. Use a different password on every account, and turn on two-factor authentication wherever it's offered.
- 4
Report misuse
If someone uses your information, report it at https://www.identitytheft.gov to get a recovery plan.
- 5
Check whether your email or phone number shows up in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to watch for.
Official filings
- California Attorney General , filed 10 Jun 2020
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Genworth data breach?
Genworth sent letters to the insurance agents whose accounts were accessed and said some of their clients might be notified too. If you got a letter, you were involved.
What was exposed?
Name, address, date of birth, telephone number, agent code, Social Security number and signature, according to Genworth's notice.
How did attackers get in?
Genworth said login credentials for a few agent accounts were compromised, and its investigation indicated they were stolen from another site.
Should I change my password?
Yes, if you reused a password between Genworth and anything else. Make each password unique.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
