Infosys McCamish Breach Reached 6.08 Million People Through the Insurers It Administered For

Infosys McCamish Systems, an Atlanta-based administrator of life insurance and annuity policies owned by the Indian outsourcer Infosys, saw unauthorised activity between Oct. 29 and Nov. 2, 2023, when ransomware encrypted its systems. Infosys disclosed the incident to the Securities and Exchange Commission on Nov. 3. LockBit listed the company on its leak site on Nov. 4. The administrator later told regulators it had substantially restored its systems by Dec. 31.

A LockBit representative told HIPAA Journal that the company had offered $50,000, which the group refused before publishing data. That is the attackers’ account and is carried as one. No payment was reported.

Bank of America notified 57,028 deferred-compensation plan participants in February 2024, and its letter was the first public description of what had been lost. Fidelity Investments Life Insurance followed with about 28,000. Oceanview Life and Annuity, Union Labor Life and the Newport Group appeared in reporting. In April 2024 Infosys said an e-discovery vendor had identified up to about 6.5 million individuals. The administrator’s amended Maine filing of June 27, 2024, put the figure at 6,078,263 and named further clients: T. Rowe Price, New York Life Group Benefit Solutions, Principal Life, Vanguard and Prudential.

The fields ran to names, addresses, birth dates, Social Security numbers, driver’s license and passport numbers, account credentials, financial account and policy numbers, salaries, medical information, biometric data and tribal and military identification numbers.

A life insurer sells a policy and pays a claim decades later. Between those events someone keeps the record, bills the premium and processes the change of beneficiary. For many carriers that someone is an outsourced administrator, and the administrator holds the whole book. The corpus filed the same structure at Landmark Admin, 24-1023, a year later. Six million people in this file had a relationship with New York Life or Vanguard and none with Infosys, and the letter that reached them came from a name they did not know.

Infosys reported $38 million in lost revenue and incident costs for the year to March 2024. Six class actions in the Northern District of Georgia consolidated and settled for $17.5 million, with final approval on Dec. 18, 2025. No regulatory penalty was found. Divided by 6,078,263, the settlement is under $3 a person before fees.