Jackson Financial Inc. Form 8-K Summary
Business context and reporting period
Jackson Financial Inc. filed a Form 8-K under Item 8.01 on June 20, 2023, regarding a cybersecurity incident involving Progress Software’s MOVEit Transfer software. The report was signed on June 26, 2023. Jackson National Life Insurance Company uses third-party vendor Pension Benefit Information, LLC (PBI), to search databases for deceased policyholders and contract holders to help identify potential beneficiaries.
Financial metrics and liquidity
The filing does not provide revenue, profit, cash flow, margins, debt, liquidity, or other quantitative financial metrics. Jackson stated that it believed the incident had no impact on its financial results and no material adverse effect on the business, operations, or financial results of Jackson Financial Inc.
Material changes and unusual items
- PBI informed Jackson that an unknown actor exploited the MOVEit vulnerability and downloaded data from PBI systems.
- Jackson’s current assessment indicates that personally identifiable information relating to approximately 700,000 to 800,000 Jackson customers was obtained from PBI systems.
- Separately, two Jackson servers were accessed. The company stated that the scope and nature of data accessed on those servers was significantly less extensive than the PBI impact.
- The unauthorized actor did not access other Jackson systems or software, and business operations were not interrupted.
Management commentary, risks, and contingencies
- Jackson launched an investigation with third-party cybersecurity specialists, secured the affected servers, patched the vulnerability, and performed a forensic analysis.
- The preliminary assessment identified a subset of information relating to certain partner organizations and individuals, including some Jackson customers, as obtained from the two affected servers.
- Jackson notified law enforcement and its primary insurance regulators and stated that it would continue providing updates.
- The company is working to identify affected individuals and plans to provide appropriate notifications, credit monitoring, and identity theft services.
- The filing cautions that forward-looking statements are subject to risks and uncertainties described in Jackson’s 2022 Form 10-K and subsequent SEC filings. The company does not undertake to update such statements except as required by law.
Key facts investors should verify
- Whether the estimated 700,000 to 800,000 affected customers changes as the investigation progresses.
- The specific types of personal information accessed and the number of individuals affected through Jackson’s own servers versus PBI’s systems.
- Any litigation, regulatory actions, notification costs, remediation expenses, insurance recoveries, or other financial effects arising from the incident.
- Whether Jackson’s assessment that there was no material adverse effect remains valid in later SEC filings.