InvestorCOM generates and distributes certain types of policyholder communications for Empire Life. The software provider told Empire Life about the breach on March 30, Smith said, and Empire Life then began an independent investigation with help from cybersecurity experts.
“Based on information provided by InvestorCOM since then, and our own investigation, we have now been able to determine that some files stored on InvestorCOM’s computer systems were affected,” Smith wrote.
The insurer has begun notifying affected clients by mail of what personal information of theirs was affected, Smith said. Empire Life will pay for three years of credit monitoring through Equifax Inc., she added.
In January, Minnesota-based Fortra LLC discovered hackers had created unauthorized user accounts with customers of its managed file transfer service, GoAnywhere. One of those customers was InvestorCOM, a vendor of Empire Life, Mackenzie Investments and other Canadian financial services firms.
InvestorCOM declined to comment beyond its May 1 statement, which said the Fortra cybersecurity incident has been contained.
Smith said Empire Life has reported the breach to law enforcement, financial services industry regulators, federal and provincial privacy commissioners, the Canadian Centre for Cyber Security and the Canadian Anti-Fraud Centre.
The Logic first reported on the Fortra incident earlier this month.