OneGroup NY Data Breach Affects Workers' Comp Information

On July 29, 2024, OneGroup NY, an insurance and risk management firm based in Syracuse, New York, discovered suspicious activity within its email environment. An investigation revealed that an employee’s email account had been accessed without authorization between May 6, 2024, and May 21, 2024.

While the company could not determine exactly which emails were accessed or viewed, a comprehensive programmatic and manual review was conducted to identify the types of information potentially exposed and the individuals affected. This review concluded on February 4, 2025 and confirmed it involved personal information associated with MEMIC Indemnity-issued workers’ compensation accounts.

The company disclosed the incident to the Vermont Attorney General’s office on June 9, 2025. While the exact number of affected individuals was not detailed in the public notice, the breach’s scope was significant enough to prompt a formal notification and the provision of identity protection services. For those seeking more details, the official disclosure is available on the Vermont Attorney General’s website.

OneGroup NY's response

To support those affected, OneGroup NY is offering 24 months of complimentary credit monitoring and identity protection services through TransUnion. Affected individuals must enroll themselves in these services within 90 days of receiving the notification letter. Instructions and a unique code for enrollment are provided in the consumer notice, which can be referenced at the end of this article.

Given the nature of the breach—unauthorized access to an employee’s email account—affected individuals are encouraged to remain vigilant for signs of identity theft or fraud. It is recommended to:

• Review account statements and explanation of benefits statements.
• Monitor free credit reports for suspicious activity.
• Consider placing a fraud alert or credit freeze with the major credit bureaus.

Additional guidance and contact information for the credit bureaus, as well as steps on how to protect personal information, are included in the official notice.

For more information about the company or to contact them directly, visit their official website.