Genworth Financial, Inc. (the “Company”) has been notified by PBI Research Services (“PBI”), a third-party vendor to the Company, that PBI, in common with numerous other organizations and governmental agencies, was subject to the widely reported security events involving the MOVEit file transfer system, which PBI uses in the performance of its services. The MOVEit file transfer system security event resulted in the unauthorized acquisition by a third-party of data from several organizations and governmental agencies, including Company data. As further described below, the Company believes that the personal information of a significant number of insurance policyholders or other customers of its life insurance businesses was unlawfully accessed, and is working to ensure that protection services are provided to those impacted individuals. The Company believes that the PBI security event has not had any impact on any of the Company’s information systems, including its financial systems, and that there has not been any material interruption of the Company’s business operations. The Company’s Enact mortgage insurance business was not affected by the incident. While the Company is continuing to measure the impact, including certain remediation expenses and other potential liabilities, the Company does not currently believe this incident will have a material adverse effect on its business, operations, or financial results.
PBI is a third-party vendor that provides services to various companies in the insurance industry. The Company’s life insurance businesses use PBI to, among other things, satisfy applicable regulatory obligations to search various databases to identify the deaths of insured persons under life insurance policies, and to identify the deaths of insured persons under long-term care insurance, and annuity policies which can impact premium payment obligations and benefit eligibility. For life insurance policies and annuity contracts, this helps identify the possible eligibility of beneficiaries for death benefits even prior to the submission of claims, or for policies that beneficiaries may not know exist.
Since receiving notification of the security event, the Company, together with PBI, promptly launched an investigation to determine to what extent personal information had been unlawfully accessed by the threat actor. While that investigation is still ongoing, it is the Company’s understanding, based on the current state of the investigation that approximately 2.5-2.7 million policyholders’ or other customers’ personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the PBI security event.
The Company will ensure that appropriate notification is provided to individuals affected by this security event, as well as to regulatory agencies as required by federal and state law. In addition, impacted individuals will be offered credit monitoring and identity theft protection services. Additional information and contact information can be found at www.genworth.com/moveit.
With respect to any impact on the Company, the Company does not itself use the MOVEit file transfer system, and PBI has informed the Company that it has rectified the vulnerability that allowed the incident.
Forward Looking Statements
This Current Report on Form 8-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, Section 21E of the Securities Exchange Act of 1934, as amended, and the Private Securities Litigation Reform Act of 1995 that involve risk and uncertainties. These forward-looking statements are based on our current beliefs, understandings and expectations and may relate to, among other things, statements regarding our current beliefs, understanding and expectations regarding this cyber incident and its impact on our business, operations and financial results. These forward-looking statements are neither promises nor guarantees, but are subject to a variety of risks and uncertainties, many of which are beyond our control, which could cause actual results to differ materially from those contemplated in these forward-looking statements. Factors that could cause actual results to differ materially from those expressed or implied include legal, reputational, and financial risks resulting from this cyber incident, our ongoing investigation of the incident, including the Company’s potential discovery of additional information related to the incident in connection with this investigation, any potential regulatory inquiries and/or litigation to which the Company may become subject in connection with this incident, the extent of remediation and other additional costs that may be incurred by the Company in connection with this incident, the extent of insurance coverage and contractual indemnification, and the risks set forth in our Annual Report on Form 10-K for the year ended December 31, 2022, filed with the Securities and Exchange Commission on February 28, 2023, and our other filings with the Securities and Exchange Commission. The Company undertakes no obligation to revise or update any forward-looking statements, or to make any other forward-looking statements, whether as a result of new information, future events or otherwise.
