Catholic United Financial cuf.org Catholic United Financial data breach: what happened and what to do
Catholic United Financial noticed a possible intrusion on its web server on September 6, 2017 and reported it to California's Attorney General on October 6, 2017. News reports say members' names, addresses, dates of birth and Social Security numbers may have been exposed.
View all 13,177 breaches- Breach date
- 6 Sept 2017
- Made public
- 6 Oct 2017
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
On September 6, 2017, Catholic United Financial, a fraternal financial services provider based in Roseville, Minnesota, became suspicious that its web server had been broken into. According to the company's notice to members, filed with the California Attorney General, it shut down its website and hired an outside forensic firm. The notice appears on the California Attorney General's breach list with a reported date of October 6, 2017.
News coverage says the forensic work found the web server was attacked through SQL injection, a technique where an attacker sends crafted input to a website to pull data out of its database. One report puts the number of current and former members who may be affected at 127,310.
Sources checked: oag.ca.gov, thecatholicspirit.com, dglobe.com
Last verified against the official page:
What was exposed
Reports list names, mailing addresses, dates of birth, email addresses, insurance policy information and Social Security numbers. The company said member funds, beneficiary information and account log-in details were not at risk, as The Catholic Spirit reported.
A Social Security number together with a name and date of birth is what criminals use to open credit in someone else's name. Email addresses and mailing details feed phishing that can sound convincing because it mentions a real policy or the breach itself.
The company's response
Catholic United Financial said it would give members two years of identity and credit monitoring at no charge. If you received a letter, it explains how to sign up.
What to do if you were in it
- 1
Use the free monitoring if you were offered it
The company said it would provide two years of identity and credit monitoring. The FTC says to take up free credit monitoring when a breach notice offers it.
- 2
Freeze your credit
Because Social Security numbers were reported exposed, place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how: freezing stops lenders from seeing your report, so new accounts in your name are blocked until you lift it.
- 3
Watch for phishing that mentions your policy
Emails, calls and texts that quote policy details or the breach are a common follow-up. Don't click links in them. Contact the company using a number from its own website or your statements.
- 4
Read your statements and credit reports
Look for accounts or charges you don't recognize. You can get your reports free at annualcreditreport.com and report identity theft at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see where your email or phone number has shown up. Serus can't remove data from a breach, but it alerts you and tells you what to do.
Official filings
- Washington Attorney General , filed 6 Oct 2017 : 704 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the Catholic United Financial breach?
Members were notified by letter. News reports said current and former members could be affected, including deceased members. If you were a member and got no letter, contact the company directly.
What was exposed?
Reports list names, addresses, dates of birth, email addresses, insurance policy information and Social Security numbers. The company said beneficiary information and log-in details were not accessed.
Is there a settlement?
The sources used for this page don't mention one.
Should I freeze my credit?
If you were notified, a freeze is a sensible step since Social Security numbers were reported exposed. The FTC says it's free and lasts until you lift it.
Sources
- oag.ca.gov/system/files/Catholic%20United%20Financial%20Template%20Consumer%20Notice_0.pdf
- oag.ca.gov/privacy/databreach/list
- thecatholicspirit.com/news/local-news/catholic-united-financial-addresses-security-breach/
- dglobe.com/business/data-breach-at-twin-cities-based-catholic-financial-services-provider-affects-nearly-130k-accounts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
