Gregory & Appel Insurance (G&A) Data Breach Details
On or about February 5, 2025, Gregory & Appel Insurance (G&A) detected suspicious activity involving a fraudulent email impersonating the company’s Chief Financial Officer. The email was sent to a G&A employee, prompting an immediate security review. An internal investigation later revealed that an employee had inadvertently emailed W-2 tax forms containing sensitive personal data to an unauthorized recipient.
Upon discovering the incident, Gregory & Appel took swift action to secure its email systems and mitigate further risks. The company conducted a comprehensive review of its security policies and implemented additional safeguards to prevent similar breaches in the future. Additionally, G&A has notified the appropriate state regulators as required by law.
To support those affected, Gregory & Appel is offering complimentary access to credit monitoring and identity restoration services through IDX for 24 months. Instructions for enrollment were included in data breach notification letters sent to impacted individuals on March 5, 2025.
What Information Was Compromised?
The data breach exposed confidential employee information, including names and Social Security numbers. Given the nature of this information, affected individuals may be at risk for identity theft and financial fraud.
