CNA Financial
Disclosed Mar 23, 20215 years ago75,349 affectedConfirmed
Ransomware attack on insurer copies employee and policyholder data
CNA sustained a sophisticated ransomware attack in March 2021, and its investigation found that an unauthorized party copied personal information of some current and former employees, contractors and policyholders.
What is known
| People affected | 75,349 (as reported by the organization) |
|---|---|
| Disclosed | Mar 23, 2021 |
| Discovered | Mar 21, 2021 |
| Happened | Mar 5, 2021 |
| Attack | Ransomware |
| Data exposed | Names, Social Security numbers, Employment, Insurance, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: CNA Financialoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: CNA Financialatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: CNA Financialjustice.oregon.gov · Official notice | Official notice |
| CNA Financial 10-Q for Q2 2021sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2021 data breach report: CNA Financialin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): CNA Financial (Health Plan, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Mar 23, 2021 | |
| California AGresidents of CA | Jul 8, 2021 | |
| Washington AGresidents of WA | Jul 8, 2021 | 823 |
| HHS archivetotal | Jul 8, 2021 | 5,095 |
| Oregon DOJresidents of OR | Jul 9, 2021 | 75,349 |
| Indiana AGresidents of IN | Jul 9, 2021 | 1,958 |
History of this record
- 2026-09-25 · data_types: ["names","ssn","employment","insurance"] to ["names","ssn","employment","insurance","health"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 75349 · backfill source
- 2026-09-25 · sector: finance to insurance · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","employment","insurance"] · seed source
- 2026-09-25 · disclosed: 2021-07-08 to 2021-03-23 · seed source
- 2026-09-25 · summary: empty to CNA sustained a sophisticated ransomware attack in March 2021, and its investigation found that an unauthorized party copied personal information of some current and former employees, contractors and policyholders. · seed source
- 2026-09-25 · title: empty to Ransomware attack on insurer copies employee and policyholder data · seed source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2021-03-21 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.