Kelly Benefits December data breach impacted over 400,000 individuals
May 05, 2025 
Kelly Benefits has determined that the impact of the recently disclosed data breach is much bigger than initially believed.
Benefits and payroll solutions firm Kelly & Associates Insurance Group, aka Kelly Benefits, announced that the impact of a recently disclosed data breach is much bigger than initially estimated.
The U.S.-based company provides benefits, payroll, and workforce management solutions to businesses.
In April, Kelly Benefits disclosed a data breach where hackers accessed its systems from Dec 12–17, 2024, stealing sensitive personal data. Initially the company believed that the incident impacted nearly 264,000 people, including clients of firms like CareFirst, Guardian, and Beam Benefits. Exposed info includes names, SSNs, medical and financial data. The company is notifying impacted individuals on behalf of several customers.
Kelly Benefits is notifying affected individuals on behalf of multiple customers, including CareFirst, Guardian, Beam Benefits, and others impacted by the breach.
The number of impacted individuals has grown to 413032, and the investigation is still ongoing.
“On May 2, 2025, Kelly Benefits mailed notice to an additional one hundred thirty-five (135) Maine
residents on behalf of itself and the entities listed in Exhibit A. The information that could have
been subject to unauthorized access for the additional Maine residents includes name, Social
Security number and financial account information.” reads the update provided by the company that was shared with Maine AG. “As such, a total of seven thousand one hundred sixty-four (7,164) Maine residents have now been notified of this event.”
The company did not share details about the attack, no ransomware group claimed responsibility for the intrusion.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)