Employee benefits administrator, Kelly & Associates Insurance Group, based in Sparks, Maryland, dba Kelly Benefits, has published edited figures on the number of people impacted by a cyberattack on December 2024. On April 9, 2025, Kelly Benefits at first reported the data breach as an event related to unauthorized access to the information of 32,234 people. A few weeks afterwards, on April 21, 2025, the number of impacted people went up to 263,893. The total was modified again as 413,032 affected persons were found, with 12 more clients identified. The breach notice indicates that the total might go up again. Listed below are the confirmed companies affected by the Kelly Benefits data breach.
Companies Impacted by Kelly Benefits Data Breach
- Aetna Life Insurance Company
- Amergis
- Allergis
- Beltway Companies, LLC
- Beam Benefits
- CareFirst BlueCross BlueShield
- Fidelity Building Services Group
- Intercon Truck of Baltimore, Inc.
- Humana Insurance ACE
- Maxim Healthcare Services, Inc.
- Nutramax Laboratories Inc.
- Quantum Real Estate Management, LLC
- Publishers Circulation Fulfilment, Inc.
- Populus
- Renaissance Life & Health Insurance Company of America
- Reliance Standard Life Insurance Company
- Skyline Technology Solutions LLC
- Single Affiliated Covered Entity
- Sun Life Assurance Company of Canada
- The Guardian Life Insurance Company of America
- Transforming Lives Inc.
- United Healthcare Services, Inc.
- United Concordia Companies
- University of Maryland Medical System
- Virtua Health
- Virtual Service Operations
- Young Life
Several HIPAA-covered entities reported the data breach themselves and were not included in the 413,000 reported by Kelly Benefits. For example, Lincoln National Corporation, also known as Lincoln Financial, submitted a breach report to the HHS’ Office for Civil Rights indicating that 1,123 individuals were affected.
Kelly Benefits explained in its breach notification letters that it discovered suspicious activity within its network on December 17, 2024. Third-party digital forensics experts investigated the activity and confirmed unauthorized network access from December 12, 2024 to December 17, 2024. At that time, the attacker copied files from its system. The forensics experts completed the file analysis on March 3, 2025, and Kelly Benefits mailed the notification letters to the impacted persons on May 2, 2025.
The incident exposed different types of data for the individuals affected. This data might include names, birth dates, Social Security numbers, medical insurance data, financial account details, and health data. The impacted persons were provided free credit monitoring and identity theft protection services for one year.
With the increase in the victim count comes the rise in the number of lawsuits filed against Kelly Benefits associated with the data breach. More than twelve class action lawsuits were filed, and more are expected. As a HIPAA business associate, Kelly Benefits must ensure HIPAA compliance, and this aspect may be investigated as well, with the rise of lawsuits filed against it.