LockBit ransomware group has stolen data belonging to 6 million individuals

Infosys McCamish Systems (IMS) disclosed that the LockBit ransomware attack it suffered earlier this year impacted sensitive information of more than six million individuals. IMS is a multinational corporation that provides business consulting, information technology, and outsourcing services. It specializes in covering the needs of firms in the insurance and financial services industries.

The company has a significant presence in the U.S., serving large financial institutions such as the Bank of America and seven out of the top ten insurers in the country. In February 2024, Infosys McCamish Systems (IMS) informed the public that it had been hit by a ransomware attack in November 2023. This attack resulted in the compromise of the personal data of about 57,000 Bank of America customers.

In a recent notification shared with U.S. authorities, Infosys McCamish Systems (IMS) revealed that the November 2023 ransomware attack, initially believed to have affected about 57,000 Bank of America customers, has actually compromised the personal data of over 6 million individuals. LockBit had previously claimed responsibility for the attack, stating that they had encrypted 2,000 computers on the IMS network.

The notification detailed that, with the assistance of third-party eDiscovery experts retained through outside counsel, IMS conducted a thorough and time-intensive review of the compromised data. This review was aimed at identifying the personal information that had been subject to unauthorized access and acquisition and determining the individuals to whom this information pertains.