Sedgwick Government Solutions confirmed that an unauthorized party accessed an isolated file transfer system and that a ransomware group publicly claimed theft of data, triggering incident response actions.
Incident Confirmation
Sedgwick Government Solutions (SGS) acknowledged unauthorized access to an isolated file transfer system. SGS initiated incident response procedures upon detection of the unauthorized access and engaged cybersecurity experts to investigate. According to the investigation, SGS’s core operational systems and claims management servers were not affected by the unauthorized access.
Claims by Ransomware Group
On December 31, 2025, the TridentLocker ransomware group publicly listed SGS as a victim on its dark web leak site. It posted around 3.39 gigabytes of stolen data on its site. TridentLocker employs tactics that combine data exfiltration with threats of data exposure following encryption.
Managed Care Advisors and SFTP Server Incident
Managed Care Advisors and Sedgwick Government Solutions reported that unauthorized access occurred after a third party exploited a vulnerability in a corporate SFTP server. The server stored personal information and protected health information (PHI). Access to the server started on November 16, 2025. SGS detected the attack on December 4, 2025, after which activated incident response procedures and disabled connections to the SFTP server. SGS restored the encrypted data from backups the following day.
Data Elements Involved
On January 15, 2026, Sedgwick’s investigation confirmed that the compromised server contained first and last names, addresses, Social Security numbers, dates of birth, and PHI. The types of data varied among affected individuals.
Mitigation and Protective Measures
A cybersecurity firm assisted with the investigation and forensic analysis after the incident was confirmed. The organization stated that it had implemented cybersecurity measures prior to the incident and took additional steps to enhance privacy protections following the unauthorized access.
Notification to Affected Individuals
In compliance with HIPAA breach notification laws, notifications sent to affected individuals included offers of complimentary credit monitoring and identity theft protection services, with identity theft insurance included in the offered services. Information on the total number of individuals affected was not available at the time of reporting.
