Cybersecurity Attack

On March 21, 2021, CNA determined that it sustained a sophisticated cybersecurity attack. The attack caused a network disruption and impacted certain CNA systems.

Upon learning of the incident, we immediately engaged a team of third-party forensic experts to investigate and determine the full scope of this incident, which is ongoing. We have notified law enforcement and are cooperating with them as they conduct their own investigation.

Out of an abundance of caution, we took immediate action by proactively disconnecting our systems from our network. We’ve notified employees and provided workarounds where possible to ensure they can continue operating and serving the needs of our insureds and policyholders to the best of their ability.

We are well into the restoration phase and making significant progress across our internal systems to safely return our environment to a fully operational state. Importantly, we have restored corporate email and have brought the CNA.com website back online. We expect the restoration of additional critical functions to proceed in the near future and will continue to update employees and stakeholders as information becomes available.

The security of our data and that of our insureds and other stakeholders is of the utmost importance to us. Should we determine that this incident impacted our insureds’ or policyholders’ data, we’ll notify those parties directly.

We have established the following dedicated email inboxes to meet the needs of our insureds and policyholders:

We are committed to keeping you apprised of the latest developments. Thank you for your patience.