Sedgwick Government Solutions

Summary

Sedgwick Government Solutions confirmed a cyberattack after the ransomware group TridentLocker claimed to have stolen about 3.4 gigabytes of data from an isolated file transfer system used by the subsidiary. The company said the breach did not affect its broader network or the ability to serve clients, and that it activated incident response procedures, involved cyber experts, and notified law enforcement while TridentLocker leaked the data publicly.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Sedgwick confirmed a cyberattack on its subsidiary Sedgwick Government Solutions after the TridentLocker ransomware group claimed responsibility for the breach. The subsidiary, which provides claims and risk management services to U.S. government agencies including the Department of Homeland Security, the Cybersecurity and Infrastructure Security Agency, and various municipalities, detected the incident and immediately activated its incident response protocols. Sedgwick’s spokesperson stated that the company was addressing a security incident at Sedgwick Government Solutions and had engaged cyber experts to conduct an investigation. The response began promptly following detection, with the third‑party administrator coordinating internal and external resources to assess the situation.

The company reported that the attack was confined to an isolated file transfer system and did not affect the broader network of Sedgwick Government Solutions or any other Sedgwick systems. Sedgwick emphasized that its subsidiary is segmented from the rest of its business, ensuring that no wider corporate data or systems were compromised. Representatives noted there was no evidence of access to claims management servers and that the incident did not impair the subsidiary’s ability to serve its clients. As part of the response, Sedgwick notified law enforcement agencies and maintained ongoing communication with its clients while the investigation proceeded. These actions were taken to contain the breach and preserve operational continuity.

On New Year’s Eve, TridentLocker publicly claimed to have exfiltrated approximately 3.4 gigabytes of data from Sedgwick Government Solutions and leaked the information online. Sedgwick did not comment on the hackers’ assertions regarding the data theft. TridentLocker, first observed in November, operates as a double‑extortion ransomware group that also identifies itself as a data broker and had previously listed a dozen victims on its Tor‑based leak site, including IQS, LGM Holdings, Noment Inc., and the Belgian postal and package delivery service Bpost. The incident concluded with Sedgwick’s confirmation of the breach, its containment efforts, and the public disclosure of the attacker’s claims, without further detail on the specific data involved or any additional impact beyond what was stated.

Sources

Sources available to members: 2 sources.