Globe Life’s Extortionist Sent Stolen Data to Short Sellers and Plaintiffs’ Lawyers

Globe Life Inc. told the Securities and Exchange Commission on Oct. 17, 2024, that an unknown actor was trying to extort money from the company in exchange for not disclosing data traced to its American Income Life Insurance Co. subsidiary. The data concerned about 5,000 people, a figure the company said was not fully verified. There was no ransomware and no operational interruption. The actor, the filing said, had shared information on a limited number of individuals with short sellers and plaintiffs’ attorneys.

On Jan. 30, 2025, an amended filing confirmed the 5,000 figure, said the company had not paid, and added that it would notify about 850,000 additional people whose data sat in the same databases even though it could not confirm the actor had taken it. The databases, by later reporting, were maintained by a small number of independent agency owners who sell the subsidiary’s policies.

Most extortion threatens publication. This one threatened the share price. Sending stolen customer data to short sellers and to lawyers who file class actions is a way to convert a breach into a securities event and a litigation event before the company has decided what to do. The fields were names, contact details and, for some, birth dates, Social Security numbers, health information and policy details. Globe Life had already been the subject of a short-seller report earlier in 2024, and the company had disclosed a separate portal vulnerability in June. No source connects the June finding to the October extortion, and the file does not.

The two numbers describe two different things. Five thousand is what the company could tie to the actor. Eight hundred and fifty thousand is everyone in the databases the actor reached. The corpus records the same choice at 26-0715b, where an insurer notified everyone in a system rather than everyone it could prove was taken. It is the more honest approach and the more expensive one, and the class action that followed certified a settlement class of 532,578, somewhere between the two.

That settlement, up to $4.66 million with $3.4 million for the class, received preliminary approval in July 2026. The company said it would submit claims to its insurers. The SEC told Globe Life in July 2025 that it had concluded an investigation and would not recommend enforcement; the release does not say what the investigation concerned.