Skip to content
Breach Index · running record

Principal Financial Group data breaches (2016-2026): the Infosys McCamish vendor attack and small disclosure errors

Principal’s public record over ten years is one large vendor incident and a handful of small, self-reported mistakes. The vendor, Infosys McCamish Systems, ran systems for Principal’s group universal life insurance and was hit by ransomware in late 2023. This page sets out what Principal and the reporting said, and what is still unknown.

Short answer

Was Principal Financial hacked?

We found no confirmed breach of Principal Financial Group’s own systems by an outside attacker from 2016 to 2026 in the sources we read. Its one large incident was at a vendor: Infosys McCamish Systems (IMS), which ran systems used to service Principal’s group universal life customers, was hit by ransomware between 29 October and 2 November 2023.

In November 2023 Principal said it had no evidence its data had been compromised. By September 2024 PLANADVISER reported that Principal Life Insurance Co. had been named among the clients hit; IMS’s Maine filing gave 6,078,263 people across all its clients, with data including Social Security numbers and dates of birth. We found no Principal-only count.

Principal has also sent small breach notices for its own mistakes, such as a May 2023 email that attached one client’s tax form to a reply to another client. These were errors, not attacks.

Timeline at a glance

  1. May 2021Small inadvertent disclosure notified to Maine residents (via search). (Maine AG listing)Reported
  2. Feb 2022Misdirected file: 137 people, one in Maine (via search). (Maine AG listing)Reported
  3. 29 Oct - 2 Nov 2023Ransomware attack on vendor Infosys McCamish Systems. (PLANADVISER / Maine AG)Confirmed
  4. 16 Nov 2023Principal says the IMS event disrupted group universal life servicing; no evidence its data was compromised yet. (PLANADVISER)Confirmed
  5. Sep 2024IMS total rises to 6,078,263 people across clients; Principal Life reported among those hit. (PLANADVISER)Reported

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Principal Financial Group incident timeline, in detail

Confirmed = acknowledged by Principal Financial Group, a regulator filing or a court. Reported = credible reporting Principal Financial Group has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Oct 2023 - Sep 2024ReportedThird-party / insurance administration vendor

Ransomware at vendor Infosys McCamish disrupts Principal’s group universal life business

What happened. Infosys McCamish Systems, an insurance and retirement platform provider, found on 2 November 2023 that its systems had been encrypted by ransomware after unauthorized activity from 29 October. PLANADVISER reported on 16 November 2023 that the event disrupted applications and systems Principal used to service its group universal life customers; Principal said it had no evidence at that time that its data was compromised. This was the vendor’s system, not Principal’s network.

Impact. IMS’s amended Maine filing gave 6,078,263 people in total, with data including Social Security numbers, birth dates, emails, usernames and passwords, licence and passport numbers and financial account information (PLANADVISER, September 2024). That total covers all IMS clients. PLANADVISER said Principal Life had previously been reported as hit; we found no Principal-specific number. IMS offered 24 months of Kroll monitoring.

Sources: PLANADVISER, 16 Nov 2023 · PLANADVISER, 11 Sep 2024

2019 - 2023ConfirmedHuman error / misdirected data

Small self-reported disclosure errors: misdirected email and files

What happened. Principal has notified individuals about its own mistakes. A June 2023 notice posted by Montana’s Department of Justice says a Principal employee answering one client’s request attached another client’s 2022 1099-INT tax form on 12 May 2023; the recipient reported it straight away. Maine AG listings (seen via search) show a February 2022 misdirected file affecting 137 people and a May 2021 disclosure; search results also mention a 2019 coding error that displayed 583 customers’ details.

Impact. The 2023 letter lists name, address, the last four digits of the Social Security number and an account number, and offered one year of Equifax credit monitoring. The other counts were not checked against the filings themselves.

Sources: Maine AG listing, Feb 2022 (via search) · Maine AG listing, May 2021 (via search)

Where the reports disagree

  • Was Principal data taken by the Infosys McCamish attackers? Principal said in November 2023 it had no evidence of it. PLANADVISER later reported Principal Life among those hit, and search results describe an IMS notice about Principal Life group universal life certificates, which we could not open. We tag the incident Reported, not Confirmed, for Principal.
  • How many Principal customers? The 6,078,263 figure is IMS’s total across all clients, not a Principal count. No Principal-specific figure was found.

The pattern across the record

Outsourced insurance administration is the exposure

The one large incident hit a platform vendor that ran policy servicing for Principal and other insurers and record-keepers. The same IMS attack touched several retirement and insurance firms at once.

Small errors are reported, which is good practice

Principal sends formal notices even for one misdirected tax form. Those notices show up in state databases and can look alarming, but they are not hacks.

What it means for Principal Financial Group customers — and what to do

If you held Principal group universal life coverage through an employer, your details may have been in the Infosys McCamish data. The main risk is identity fraud using your Social Security number and date of birth.

  1. 1.Check whether you received an IMS letter

    The letters came from Infosys McCamish, not Principal. Read which data it lists and enrol in the monitoring if still open.

    Breach notice decoder
  2. 2.Freeze your credit

    A credit freeze with the three US bureaus is free and blocks new accounts opened with a stolen SSN.

    SSN exposure action plan
  3. 3.Change reused passwords

    IMS listed usernames and passwords among the exposed data. If you reused a password from an IMS-run portal, change it everywhere.

    Phishing-resistant MFA planner

CISO takeaways

Know which vendors run your policy systems

Ask administration vendors about ransomware recovery and how fast they will name affected clients.

Vendor Risk Scorecard
Practise the vendor ransomware call

Run the first days after a platform vendor goes dark and cannot yet say whose data was taken.

Vendor Breach Lab
Have a third-party breach checklist

Contracts, notices, regulators and customer letters when the breach is someone else’s.

Third-party breach checklist

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Infosys cybersecurity event disrupting recordkeeper, insurance platforms — PLANADVISER, 16 Nov 2023
  2. 2.Infosys breach in 2023 exposed personal data of 6 million people — PLANADVISER, 11 Sep 2024
  3. 3.Maine AG data breach listing: Principal, Feb 2022 (via search) — Maine Attorney General, 2022
  4. 4.Maine AG data breach listing: Principal, May 2021 (via search) — Maine Attorney General, 2021

Frequently asked questions

Was Principal Financial hacked?

We found no confirmed hack of Principal’s own systems from 2016 to 2026. Its vendor Infosys McCamish Systems, which serviced Principal’s group universal life business, was hit by ransomware in late 2023.

Was Principal affected by the Infosys McCamish breach?

Principal said the attack disrupted systems used for its group universal life customers. In November 2023 it said it had no evidence its data was compromised; later reporting listed Principal Life among those hit. No Principal-only count was found.

Was Principal part of the MOVEit breach?

We found no Principal notice tied to MOVEit in the sources we read.

Is there a Principal Financial data breach settlement?

We found no settlement naming Principal in the sources we read.

Why did I get a Principal “Notice of Data Breach” letter?

Principal sends formal notices for small errors too, such as a tax form emailed to the wrong client. Read the letter: it says what happened and which data was involved.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Principal Financial Group. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.