Liberty Mutual hit with lawsuit over Everest ransomware data leak

A new lawsuit accuses Liberty Mutual Insurance Co. of failing to protect sensitive personal and medical information allegedly stolen in a ransomware attack tied to the cybercriminal group Everest.

The hackers reportedly stole a massive trove of sensitive data and have begun leaking documents online after a brief ransom negotiation window expired, according to various reports.

The lawsuit, filed on behalf of current and former customers as a proposed class action, alleges that Liberty Mutual and/or one of its third-party vendors is responsible for the April 30 data breach. The insurer allegedly exposed personally identifiable information and protected health information, including Social Security numbers, financial records and medical data.

“Defendant has yet to provide direct notice to those impacted, leaving victims in the dark of their increased risk of imminent fraud and identity theft,” plaintiffs say in the lawsuit filed May 6.

According to the complaint filed in the District of Massachusetts Eastern Division, the Everest ransomware group claimed responsibility for the attack and allegedly posted Liberty Mutual’s name and logo on its dark web leak site. Plaintiffs allege that the hackers threatened to publish stolen records unless a ransom was paid.

Liberty Mutual did not respond to a request for comment.

‘Significant time and effort’

Robert Francis and John Goodwin, both Massachusetts residents, are the listed plaintiffs. Francis provided Liberty Mutual with personal information, including his Social Security number, date of birth, financial details and health insurance information while obtaining coverage through his employer, the lawsuit said.

After the data breach, Francis began receiving “spam, scam and phishing text messages and phone calls.” The lawsuit further describes how the steady stream of spam messages is “a distraction” and a daily waste of Francis’s time.

“Francis has spent -- and will continue to spend -- significant time and effort monitoring his accounts, his credit files and his financial statements to protect himself from fraud and identity theft,” the lawsuit said.

Goodwin has suffered from “anxiety, sleep disruption, stress, fear and frustration,” the lawsuit claimed. “Such injuries go far beyond allegations of mere worry or inconvenience. Rather, Plaintiff Goodwin’s injuries are precisely the type of injuries that the law contemplates and addresses.”

Plaintiffs: Sensitive info exposed

Plaintiffs allege the company failed to adequately encrypt or safeguard sensitive customer information and did not implement reasonable cybersecurity measures to prevent unauthorized access to its systems. The complaint further alleges that Liberty Mutual violated promises made in its privacy policies regarding the protection of customer data.

The lawsuit also claims affected customers face ongoing risks because their information may already have been published or otherwise shared on the dark web. Plaintiffs allege the exposure of sensitive data has caused emotional distress, anxiety and fear over potential misuse of their information.

The lawsuit seeks damages and injunctive relief on behalf of a proposed nationwide class of affected individuals.

© Entire contents copyright 2026 by InsuranceNewsNet.com Inc. All rights reserved. No part of this article may be reprinted without the expressed written consent from InsuranceNewsNet.com.

InsuranceNewsNet Senior Editor John Hilton has covered business and other beats in more than 20 years of daily journalism. John may be reached at [email protected]. Follow him on Twitter @INNJohnH.