Young Consulting has confirmed that it lost sensitive data of nearly one million people in a ransomware attack that took place earlier in 2024.
The company confirmed the news by sending a message Letters about data breach notifications to exactly 954,177 customers who indicated that they had become aware of “technical problems” in their computer environment in mid-April 2024.
After investigations involving third-party forensic firms, the company concluded that access to the network was gained between April 10 and April 13. During these three days, attackers managed to steal sensitive data and then encrypt the systems to demand ransom.
BlackSuit attacks
The stolen data included people’s names, Social Security Numbers (SSN), dates of birth and insurance policy/claim information. The company said it was still investigating what types of data were stolen, but added that Blue Shield was affected. Blue Shield of California is a mutual benefit corporation and health plan founded in 1939 by the California Medical Association.
Young Consulting is a company specializing in providing software solutions tailored to the employer stop-loss insurance market. It develops integrated software designed to help insurers, brokers and third-party administrators with the marketing, underwriting and administration of medical stop-loss insurance.
The company has not disclosed who the threatening actors are, but BleepingComputer reports that a threat actor called BlackSuit has taken responsibility and has already leaked the stolen data.
The difference is that the cybercriminals claim to have stolen much more than Young Consulting claims, including business contracts, contacts, presentations, employee passports, contracts, contacts, family details, medical exams, financial audits, reports and payments, and various content stolen from personal folders and network shares.
People who fear their information has been stolen can contact Young Consulting, which offers free credit monitoring and identity theft protection.