Please see below for the latest information regarding IMG’s systems.
Why are the systems down?
On January 27th, we experienced a ransomware incident. We shut down our systems to contain the activity. Two cybersecurity firms were engaged by the end of the day to conduct an investigation and further assist us in remediation and restoration efforts. Our IT team continues to work diligently with experienced forensic consultants in cleaning and restoring our systems. The restoration process has been underway for several days and we’re continuing to make a lot of good progress.
Which systems were impacted?
All IMG systems were impacted by the cyber incident, including websites, phone lines, and internal systems. Emergency assistance phone lines were immediately restored, and since then, all U.S. phone systems have been restored. We remain available 24/7 for all emergency assistance.
Has data been accessed or acquired?
While our forensic investigation continues, as of this time, the investigation has found no evidence of data access or acquisition. The forensic investigation is thorough and will likely be ongoing for at least another few weeks.
What are you doing to fix the problem?
IMG is implementing a plan monitored by our external forensic advisors to replace impacted systems with clean devices restored from backups. We are exercising caution as we restore – organizations that rush to restore without first securing the network may become reinfected. We are taking steps to try to avoid that here while still restoring our systems as quickly as possible.
Which systems have been restored and which systems will be restored next?
Emergency assistance phone lines were immediately restored, and since then, all U.S. phone systems have been restored. European and U.K. phone systems are still coming back online, and given the backlog of service demand, service levels will take some time to restore back to normal. However, we remain available 24/7 for the following urgent and emergent requests.
• Basic travel assistance services
• Medical evacuation services
• Medical repatriation services
• Repatriation of mortal remains
• Political evacuation
• Natural disaster evacuation
• Emergency precertification
• Emergency Guarantee of Payment (GOP)
• Urgent (Unitedhealthcare network) USA benefits
• Urgent (Unitedhealthcare network) USA provider claim status
• International provider search
• Domestic provider search (UHI)
Moving forward, we are prioritizing critical systems and are moving onto the next batch of systems as we speak, which includes purchase systems, APIs, websites, administrative, claims, and other internal systems.
Can I sell plans during the outage?
We will honor non-underwritten (e.g. auto-issued) business sold on Monday, January 27, with effective dates starting Tuesday, January 28. The same rule will apply for the applicable business sold, renewed, and extended on days throughout the outage. After our relevant systems are fully restored, we will reach back out to confirm the process for sending us these transactions. The Sales Service Center is available to assist with travel medical applications until the purchase systems are restored.
How can customers check claims status, renew/extend plans, or service existing plans?
IMG staff continues to be available 24/7, but internal systems are still down, so we appreciate your patience with administrative requests such as claims and extensions. Our ability to answer specific questions about policies and claims is still extremely limited. Customers who have requests that require information not currently available to us are being advised that they need to follow up periodically to check if the systems are up and running and we can process their information.
How will commissions be issued?
The following notes on commissions are relevant for all producers (IMG, IMGe, iTI and ALC):
• We want to provide as much advance notice as possible that January commission payments for IMG U.S., U.K., and Europe producers, as well as for ALC and ITravel producers, may be delayed. We will share more detailed information on January commission payment timelines shortly
• Any premium processed prior to January 24 for January 2020 policy effective dates will be accounted for in January and will be reflected in January commission payments accordingly.
• Depending on business line and payment type, premium received between January 24 and January 27 for January 2020 policy effective dates will be included in either January or February’s commission.
• Any premium processed on or after January 27 for January 2020 policy effective dates will be applied to February.
What if this happens again?
We are doing what we can to help prevent this from happening again. We have notified law enforcement. Additionally, we contacted McAfee (one of the preeminent Computer Security Companies) and, based on this incident, it updated its antivirus software with the “signature” of this software so that it can identify and remove this virus if identified. This update is assisting us with our restoration efforts as well as other McAfee users around the world.
