First BofA, Now Fidelity: Same Vendor Behind Third-Party Breaches

Fidelity Investments Life Insurance Company notified 28,268 individuals that a third‑party service provider, Infosys McCamish (IMS), was breached between Oct. 29 and Nov. 2, and that unauthorized actors likely accessed sensitive personal data—including names, Social Security numbers, dates of birth, states of residence, and bank account/routing numbers; Fidelity is offering 24 months of TransUnion credit monitoring while it investigates and coordinates with IMS. The incident follows a recent similar IMS-related breach affecting Bank of America, underscoring ongoing third-party supply-chain risk.