Prudential Financial disclosed that a cybercrime group gained unauthorized access to its systems in February 2024. In a February 21 amendment to its SEC filing, the company said the group accessed and exfiltrated limited data that included some client information and personally identifiable information (PII). Prudential did not report a definitive total number of people affected.
What happened and when
Prudential’s SEC filings describe an intrusion that began on February 4, 2024. The company detected it the next day and later updated its disclosure as its investigation identified data exfiltration.
| Date | What Prudential disclosed |
|---|---|
| February 4, 2024 | The unauthorized access began, according to Prudential’s February 13 Form 8-K. |
| February 5, 2024 | Prudential detected the unauthorized access. |
| February 13, 2024 | Prudential filed an SEC Form 8-K describing access by a suspected cybercrime group to administrative and user data on certain IT systems, including a small percentage of user accounts associated with employees and contractors. |
| February 21, 2024 | In a Form 8-K/A amendment, Prudential said its investigation had identified access to and exfiltration from a platform of limited data that included some client information and PII. |
The February 13 and February 21 filings describe different stages of Prudential’s investigation. The amendment added the finding about exfiltrated data; it did not provide a complete inventory of the information involved.
What information was involved
Prudential’s February 21 Form 8-K/A said the group accessed and exfiltrated “limited data that includes some client information and personally identifiable information.” The company also reported access to administrative and user data and a small percentage of employee and contractor accounts.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
The public filing does not specify every data element involved or establish that every client’s information was accessed. If you received a direct notice, use that notice to determine which of your information Prudential says was affected and what protections, if any, it offers.
How many people were affected?
The official disclosures described here do not establish a definitive total number of affected individuals. A Massachusetts notification template indicates that some recipients’ personal information was affected, but it does not establish the total scope of the incident. The filings’ reference to a small percentage of employee and contractor accounts is not a count of all affected people.
What Prudential said about the attacker and system impact
As of its February 21, 2024 amendment, Prudential said: “On the basis of the investigation to date, we have not found any evidence of malware, ransomware, data destruction or alteration, or that the threat actor currently has access to our systems.” This describes what the investigation had found by that date; it is not a claim about conditions at every later date.
Prudential also said the incident had not had a material impact on operations and that, as of February 21, it had not determined the incident was reasonably likely to materially affect its financial condition or results of operations.
How Prudential responded
Prudential said it activated its cybersecurity incident-response process immediately, brought in external cybersecurity experts, reported the matter to relevant law enforcement, and informed regulatory authorities.
In its 2025 Form 10-K, Prudential described an information-security program intended to protect the confidentiality, integrity, and availability of information; an incident-response plan with escalation and evaluation processes; and an enterprise-wide third-party risk-management program. The filing also said that during the period it covered, Prudential had not identified a cybersecurity threat that materially affected or was reasonably likely to materially affect its business strategy, results of operations, or financial condition. That later description of company-wide controls does not add a public count of people affected by the 2024 incident.
Quick Recap
What to do if you received a Prudential breach letter
- Confirm the notice is genuine. Use contact details from a Prudential statement or its official website rather than a phone number or link in an unexpected message. Do not share account credentials or verification codes in response to an unsolicited call, email, or text.
- Read the notice for the specifics. Check what information it says was affected, the date of the letter, any enrollment deadline, and the contact details or protection steps it provides. Follow the notice’s instructions if you decide to use an offered service.
- Choose safeguards that match the information involved. If the notice says your Social Security number or other credit-file information was exposed, consider placing a credit freeze with each of the three nationwide credit bureaus. A freeze can make it harder for a lender to access your file for a new account, but it does not prevent every form of identity misuse. If you consider a monitoring service, review what it monitors, how quickly it alerts you, whether it offers dispute assistance, and its cost and cancellation terms.
- Review accounts and credit activity. Watch financial accounts and credit reports for transactions or applications you do not recognize. Contact the relevant bank, card issuer, or credit bureau using a known, independent contact channel if you find suspicious activity.
- Secure reused credentials where relevant. If the notice or your own account activity suggests a password was exposed—or if you reused that password elsewhere—change it on affected services and use unique passwords going forward. Enable multifactor authentication when available.
Primary disclosures
- Prudential Financial, SEC Form 8-K, filed February 13, 2024.
- Prudential Financial, SEC Form 8-K/A, filed February 21, 2024.
- Prudential Financial, 2025 Form 10-K.
- Massachusetts notification template concerning the incident; it indicates that some recipients’ personal information was affected but does not establish the overall number affected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
