Alera Group aleragroup.com Alera Group data breach: what happened and what to do
Alera Group, an insurance and benefits firm, said attackers accessed its systems between July 19 and August 4, 2024. The US health regulator's portal lists 174,378 people. Names, Social Security numbers, driver's licenses and medical information were among the data at risk.
View all 13,115 breaches- Breach date
- 19 Jul 2024
- Affected
- 174,378
- Data exposed
- Names, Physical addresses, Dates of birth, Social security numbers, Driver's licenses, Financial account information, Passport information, Medical information
- Last updated
What happened
Alera Group is a US insurance, benefits and consulting firm. It said an unauthorized party accessed its technology environment between July 19 and August 4, 2024, and confirmed on April 28, 2025 that personal data was affected (Coverager, PlanSponsor).
The number of people grew as the review went on. An early filing with the Maine Attorney General listed 10,874 people. The US health regulator's breach portal now lists 174,378.
Who was affected
Alera notified people in several roles: its own current and former employees and their dependents, and customers of employers and business partners that Alera serves. You may have been affected without ever dealing with Alera directly.
What was exposed
The notice says affected information may include names, addresses, dates of birth, Social Security numbers, driver's licenses, financial account or credit card information, passport information and medical information. Which items applied differs by person.
Social Security numbers, driver's license and passport details are what criminals use to open accounts or file fake tax returns in your name. Medical details can be used to make phishing messages sound convincing.
The company's response
Alera brought in outside cybersecurity specialists and added security measures. It advises people to watch their accounts and credit reports for 12 to 24 months, and it offers complimentary credit monitoring to affected people.
What to do if you were in it
- 1
Freeze your credit
Placing a freeze at Equifax, Experian and TransUnion stops most new accounts being opened in your name. It's free and you can lift it when you need credit (FTC guide). Do it even if you've enrolled in monitoring.
- 2
Enroll in the credit monitoring
If you got a letter from Alera, use the enrollment code it includes.
- 3
Replace exposed documents if needed
If your driver's license or passport number was listed in your letter, ask the issuing agency what they recommend. Some will flag or reissue the document.
- 4
Watch statements and credit reports
Review bank, card and insurance statements for the next 12 to 24 months, as Alera advises, and pull your free credit reports.
- 5
Check other breaches
Check whether your email or phone number shows up in this and other breaches. A free scan from Serus looks across breach databases and the dark web and alerts you when your data appears.
Frequently asked
Was I affected by the Alera Group breach?
Alera mailed notices to affected people. Because it handles benefits for employers, you may have received one even if you never heard of the company.
How many people were affected?
The US health regulator's portal lists 174,378 people. Earlier filings listed fewer as the review progressed.
What was exposed?
Names, addresses, dates of birth, Social Security numbers, driver's licenses, financial account or card details, passport information and medical information, depending on the person.
Should I freeze my credit?
If your Social Security number was affected, yes. A freeze is free at Equifax, Experian and TransUnion.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
