Retirement & Telehealth · Retirement/Investment · Regulatory action + Private litigation + Data breach
Voya Financial
Headline
Voya's 2016 breach produced an SEC settlement in 2018 that was the first enforcement action under the Identity Theft Red Flags Rule - a genuinely notable regulatory first, and the mechanism was social engineering…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Voya's 2016 breach produced an SEC settlement in 2018 that was the first enforcement action under the Identity Theft Red Flags Rule - a genuinely notable regulatory first, and the mechanism was social engineering rather than any technical exploit: callers impersonated contractors to get passwords reset. That is the same technique that produced the 2025-26 ShinyHunters campaign documented across this tracker, nearly a decade earlier. The attack that keeps working is not a new one; it is the oldest one, and it works because help desks are designed to be helpful.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual account agreements, separate from the incidents above.
Data sharing
MULTIPLE CONFIRMED INCIDENTS: (1) 2016 breach (SEC-settled 2018): intruders impersonating Voya contractors called Voya's support line and had contractor passwords reset over a 6-day period, gaining access to personal information of 5,600 customers; Voya Financial Advisors (Voya's broker-dealer/adviser subsidiary) paid $1 MILLION, without admitting or denying the findings, to settle SEC charges for violating the Safeguards Rule and Identity Theft Red Flags Rule. (2) A SEPARATE 2023 incident at Voya Financial Advisors: per its notice to Massachusetts regulators as summarized by a plaintiff law firm, Voya learned that an unauthorized third party had accessed a COMPROMISED EMPLOYEE EMAIL ACCOUNT on February 9, 2023, potentially exposing names, addresses and SSNs; notification letters went out March 14, 2023 (number affected not stated; a reported offer of 2 years of Experian credit monitoring was not verified).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (VOYA). Service route: c/o General Counsel / Corporate Secretary, New York, New York — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy voya.com/privacy-notice | Not fetched yet | NO (HTML only) |
| Terms of service voya.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website voya.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for New York