MetLife

The instructive thing about MetLife is the range. At one end, a ransomware group claimed in January 2025 to have taken a full terabyte of data from a company serving roughly 90 million customers. At the other end, an employee sent an email to the wrong company's HR contact. Both are on the incident list, and for the person whose information was in that misdirected message the outcome is identical - their data went somewhere it should not have. The sophisticated-attacker framing that dominates breach coverage quietly does insurers a favor by making these events sound like acts of nature, when a meaningful share of exposure is ordinary human error inside routine correspondence, which no amount of security spending fully engineers away.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.scworld.com/brief/metlife-purportedly-breached-by-ransomhub — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for policyholder agreements; note a 2011 Connecticut AG 'Assurance of Voluntary Compliance' with MetLife (a settlement short of a lawsuit) exists as older historical regulatory context.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (MET). Service route: c/o General Counsel / Corporate Secretary, New York, New York — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.