MetLife metlife.com MetLife data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
On November 9, 2017, a MetLife associate emailed a group life enrollment report to two people tied to a different group life customer. The attachment held names, Social Security numbers and group life coverage election amounts. MetLife offered one year of credit monitoring.
View all 13,118 breaches- Breach date
- 9 Nov 2017
- Made public
- 15 Dec 2017
- Data exposed
- Names, Social security numbers, Group life coverage election amounts
- Last updated
What happened
On November 9, 2017, a MetLife associate sent a group life enrollment report to two associates affiliated with a group life customer other than the employer of the people in the report. The notice letter, filed with the California Attorney General in December 2017, describes it as an inadvertent disclosure. It was an email sent to the wrong recipients, not an outside attack.
MetLife said it determined this was an isolated incident and that it was taking steps to stop it happening again. The notice doesn't say how many people were affected.
Sources checked: oag.ca.gov, annualcreditreport.com, identitytheft.gov
Last verified against the official page:
What was exposed
The attachment contained each person's name, Social Security number and group life coverage election amounts. Coverage amounts show how much life insurance someone chose through their employer. No bank or card details are listed.
What it lets criminals do
The Social Security number is the serious part. With a name and an SSN, someone can try to open credit, file a fake tax return or take out a loan in your name. Here the report went to two people at another company, not to a criminal forum, and the letter doesn't say it was misused. Still, an SSN can't be changed easily, so the standard protective steps apply.
MetLife's response
MetLife offered affected people one year of three-bureau credit monitoring through TransUnion, with identity theft insurance of up to $1,000,000 (policy limits apply). The letter suggests a fraud alert on your credit file as well.
What to do if you were in it
- 1
Enroll in the credit monitoring if you got a letter
The code in your letter is valid for 90 days from the notice. It's free for one year and covers all three bureaus.
- 2
Freeze your credit at all three bureaus
A freeze is free and stops most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, and lift it only when you apply for credit.
- 3
Check your credit reports
Get your free reports at annualcreditreport.com and look for accounts or inquiries you don't recognize.
- 4
Watch for tax and benefits fraud
File your taxes early and check your statements for anything you didn't do. Report misuse at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number and shows which leaks they appear in.
Official filings
- California Attorney General , filed 15 Dec 2017
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the MetLife data breach?
MetLife sent letters to the people whose group life enrollment data was in the report. If you didn't get one, you likely weren't included.
What was exposed in the MetLife breach?
Names, Social Security numbers and group life coverage election amounts.
How many people were affected?
The notice doesn't say.
Should I freeze my credit?
If you got the letter, yes. A freeze is free and blocks most new accounts opened with a leaked Social Security number.
Sources
- oag.ca.gov/system/files/CA%20Notification%20Letter%20%2810721%29_0.pdf
- Search Data Security Breaches | State of California - Department of Justice · oag.ca.gov
- Annual Credit Report · annualcreditreport.com
- IdentityTheft.gov · identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
