CNA Financial

Disclosed Mar 23, 202175,349 affectedConfirmed

Ransomware attack on insurer copies employee and policyholder data

CNA sustained a sophisticated ransomware attack in March 2021, and its investigation found that an unauthorized party copied personal information of some current and former employees, contractors and policyholders.

What is known

People affected	75,349 (as reported by the organization)
Disclosed	Mar 23, 2021
Discovered	Mar 21, 2021
Happened	Mar 5, 2021
Attack	Ransomware
Data exposed	NamesSocial Security numbersEmploymentInsuranceHealth
Sector	Insurance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: CNA Financial

Official noticeatg.wa.gov

Washington Attorney General breach notice: CNA Financial

Official noticejustice.oregon.gov

Oregon DOJ breach notice: CNA Financial

SEC filingsec.gov

CNA Financial 10-Q for Q2 2021

Official noticein.gov

Indiana Attorney General 2021 data breach report: CNA Financial

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): CNA Financial (Health Plan, IL)

Notices filed

TotalMar 23, 2021

ResearchCount not stated

Residents of CAJul 8, 2021

California AGCount not stated

Residents of WAJul 8, 2021

Washington AG823 people

TotalJul 8, 2021

HHS archive5,095 people

Residents of ORJul 9, 2021

Oregon DOJ75,349 people

Residents of INJul 9, 2021

Indiana AG1,958 people

History of this record

data_types2026-09-25

["names","ssn","employment","insurance"] to ["names","ssn","employment","insurance","health"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 75349by backfillSource

sector2026-09-25

finance to insuranceby seedSource

data_types2026-09-25

[] to ["names","ssn","employment","insurance"]by seedSource

disclosed2026-09-25

2021-07-08 to 2021-03-23by seedSource

summary2026-09-25

empty to CNA sustained a sophisticated ransomware attack in March 2021, and its investigation found that an unauthorized party copied personal information of some current and former employees, contractors and policyholders.by seedSource

title2026-09-25

empty to Ransomware attack on insurer copies employee and policyholder databy seedSource

attack2026-09-25

unknown to ransomwareby backfillSource

discovered2026-09-25

empty to 2021-03-21by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about CNA Financial