OneGroup NY reports data breach caused by compromised email account
Learn More
OneGroup NY, a Syracuse-based risk management and insurance brokerage firm, is reporting a data breach that exposed sensitive workers' compensation information belonging to clients of MEMIC Indemnity. MEMIC is an insurance company specializing in workers' compensation coverage.
The breach was caused by unauthorized access to a company email account. On July 29, 2024, OneGroup NY detected suspicious activity within its email environment and launched an investigation. The investigation confirmed that an unauthorized party gained access to the contents of an employee email account between May 6, 2024, and May 21, 2024.
The compromised email account contained confidential information belonging to workers who had filed for workers' compensation benefits through MEMIC Indemnity:
- Workers' compensation information
- Sensitive personally identifiable information associated with MEMIC Indemnity issued workers' compensation accounts. The details of what specific personal data elements were compromised (such as names, addresses, Social Security numbers, or medical information) are not disclosed.
The number of individuals affected by this data breach is not disclosed.
The review of the compromised files was completed on February 4, 2025, nearly eight months after the initial discovery. On June 6, 2025, OneGroup NY began sending data breach notification letters to all affected individuals.
