Skip to content
Breach Index · running record

Legal & General data breach history (2016-2026): the MorganAsh vendor incident and what is known

Legal & General (L&G) is a UK insurer, pension provider and asset manager with a US life arm. This page records the cybersecurity incidents we could tie to it from November 2016 to November 2026. The only one in the public record happened at a supplier.

Short answer

Was Legal & General hacked?

We found no confirmed breach of Legal & General’s own systems from 2016 to 2026 in the sources we read. We found no ICO penalty, US state breach notice or leak-site claim naming L&G or its US arm.

In June 2020 L&G suspended MorganAsh, a firm that collected medical information for its lifetime annuity and care plan quotes, after a cyber incident at MorganAsh that risked exposing clients’ medical data, Professional Adviser reported. L&G said it found no evidence its customer data was compromised, and MorganAsh said no customer data was lost.

Timeline at a glance

  1. 24 Jun 2020L&G suspends medical-data vendor MorganAsh after a cyber incident at the vendor. (Professional Adviser)Reported
  2. 25 Jun 2020MorganAsh says no customer data lost; L&G moves to an interim alternative. (COVER Magazine)Reported

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Legal & General incident timeline, in detail

Confirmed = acknowledged by Legal & General, a regulator filing or a court. Reported = credible reporting Legal & General has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jun 2020ReportedThird-party / underwriting data vendor

Cyber incident at MorganAsh, L&G’s medical-data vendor for annuity quotes

What happened. MorganAsh collected medical information for L&G quote applications for medically underwritten lifetime annuities and its Lifetime Care Plan. After learning of a cyber incident at MorganAsh, L&G launched an investigation with internal and external IT experts and suspended MorganAsh for new business quotes as a precaution, Professional Adviser reported on 24 June 2020.

Impact. L&G said it found no evidence its customer data was compromised. MorganAsh told COVER no customer data was lost and there was no data breach of customer data, with a precautionary investigation ongoing. L&G said referrals to MorganAsh covered a limited number of medical conditions and that it had an interim alternative. No count of people was published.

Sources: Professional Adviser, 24 Jun 2020 · COVER Magazine, 25 Jun 2020

The pattern across the record

Specialist vendors handle the most sensitive data

Medically underwritten annuities need health data, and L&G used an outside firm to collect it. The vendor, not the insurer, was where the risk sat.

Suspend first, investigate second

L&G paused new referrals to the vendor while it investigated, a containment step that cost business but limited new exposure.

What it means for Legal & General customers — and what to do

Nothing in the public record shows L&G customer data was stolen. The day-to-day risk for policyholders and pension savers is impersonation and pension scams using L&G’s name.

  1. 1.Verify any call about your pension or policy

    Hang up and call the number on your L&G paperwork. Never transfer a pension on the strength of an unsolicited call.

  2. 2.Secure your online account

    Use a unique password and the strongest sign-in option on your L&G account.

    Phishing-resistant MFA planner
  3. 3.If you receive a breach letter, read it closely

    Check which company was breached, which data is listed and what support is offered.

    Breach notice decoder

CISO takeaways

Tier vendors by data sensitivity

A vendor holding health data for underwriting is a top-tier supplier, whatever its size.

Vendor Risk Scorecard
Rehearse a vendor breach

Practise the decision to suspend a supplier and the customer messaging that follows.

Vendor Breach Lab

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Cyber attack: L&G suspends ties with MorganAsh over medical data incident — Professional Adviser, 24 Jun 2020
  2. 2.MorganAsh cyber attack: L&G to underwrite lifetime annuities directly — COVER Magazine, 25 Jun 2020

Frequently asked questions

Was Legal & General hacked?

We found no confirmed breach of Legal & General’s own systems from 2016 to 2026 in the sources we read. In 2020 it suspended vendor MorganAsh after a cyber incident there, and said it found no evidence its customer data was compromised.

What was the Legal & General MorganAsh incident?

MorganAsh collected medical data for L&G annuity and care plan quotes. After a cyber incident at MorganAsh in 2020, L&G suspended new referrals and investigated. MorganAsh said no customer data was lost.

Was Legal & General affected by the Capita or MOVEit breaches?

We found no report or notice naming L&G in the 2023 Capita or MOVEit incidents.

Is there a Legal & General data breach settlement or fine?

We found no ICO fine, lawsuit or settlement over a data breach at L&G in the sources we read.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Legal & General. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.