Sun Life and Health Insurance Company

Sun Life and Health Insurance Company, which operates under the alias Sun Life, is engaged in the provision of life and health insurance products to customers in the United States, as indicated by its headquarters location. The company’s life insurance offerings are designed to pay a predetermined benefit to designated beneficiaries upon the death of the insured, thereby providing financial protection against the loss of income or estate expenses. Its health insurance products are intended to help cover the costs of medical care, including hospitalization, physician services, prescription drugs, and other health‑related expenses, thereby reducing the financial burden associated with illness or injury. By concentrating on these two core lines of coverage, Sun Life addresses the primary risk management needs of individuals seeking protection against mortality and healthcare costs. The organization underwrites policies in accordance with applicable state insurance regulations and maintains contractual relationships with policyholders that outline coverage terms, premium obligations, and claim procedures. Its business model relies on collecting premiums, investing those funds to generate returns, and paying out benefits when covered events occur. Through these activities, Sun Life seeks to deliver financial security and peace of mind to its insured population.

Sun Life’s specialization in life and health insurance shapes its operational focus and risk profile, particularly with respect to the handling of sensitive personal information required for underwriting and claims administration. In May 2023, the company was affected by a global cyberattack that exploited a known vulnerability in Progress Software’s MOVEit file transfer software, an incident that impacted numerous organizations worldwide. The breach occurred through Sun Life’s vendor, Pension Benefit Information, which provides pension benefit administration services, and resulted in unauthorized access to personal data belonging to Sun Life’s U.S. customers. The compromised information included names, Social Security numbers, policy numbers, and dates of birth, while financial and medical records were not exposed according to the company’s statements. In response to the incident, Sun Life and the vendor offered affected individuals complimentary credit monitoring and identity protection services to help mitigate potential harm. The episode highlighted the organization’s reliance on third‑party service providers for certain administrative functions and underscored the importance of robust vendor risk management practices within the insurance sector. Sun Life’s communication about the breach, including notices posted on its website and filings with state attorneys general, demonstrated its adherence to breach notification obligations under applicable data protection laws.