We got a letter from them yesterday. My wife was insured by them over 2 years ago, but apparently still had her data sitting on some staffers laptop.

In 2008, they lost another 300,000 peoples data the same way, but of course they "take security seriously".

For all the time we spend worrying about PCI and HIPPA compliance, one wonders how a gigantic insurer can get away with ignoring even the most basic precautions.