Insurance · Insurance · Data breach
Liberty Mutual
Headline
The Everest ransomware group claimed in May 2026 to have taken more than 108 gigabytes of data from Liberty Mutual - a volume that, if accurate, is less a file exfiltration than a wholesale copy of a business unit.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The Everest ransomware group claimed in May 2026 to have taken more than 108 gigabytes of data from Liberty Mutual - a volume that, if accurate, is less a file exfiltration than a wholesale copy of a business unit. Ransomware crews routinely inflate their claims, so treat the figure as the attackers' assertion rather than confirmed fact until an independent notification or regulatory filing corroborates it, and that verification had not surfaced as of this pass. What can be said without qualification is that Liberty Mutual's RightTrack telematics program sits in the surcharge-capable group alongside Allstate, GEICO and Progressive - meaning the driving data it collects can move your rate in both directions, not just down.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CLAIMED MAY 2026 RANSOMWARE BREACH (attacker's leak-site claim; not independently confirmed - see headline and addendum): the 'Everest' ransomware group claimed to have stolen MORE THAN 108 GIGABYTES of data from Liberty Mutual, which the later lawsuit attributes to Liberty Mutual 'and/or one of its third-party vendors' (the vendor role is unconfirmed). Two named plaintiffs (Robert Francis and John Goodwin) filed a proposed nationwide class action in the U.S. District Court for the District of Massachusetts (May 2026); no class size has been confirmed, alleging Liberty Mutual failed to encrypt or redact sensitive personal AND PROTECTED HEALTH INFORMATION — the stolen data reportedly includes highly sensitive MEDICAL RECORDS posted to Everest's dark-web leak site. One named plaintiff reports experiencing an immediate wave of spam/scam/phishing texts after the breach; the other reports anxiety, stress, sleep disruption and fear (fraudulent charges are not specifically alleged in the reported complaint).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (Non-public). Service route: c/o General Counsel / Corporate Secretary, Boston, Massachusetts — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy libertymutual.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service libertymutual.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website libertymutual.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Massachusetts