The California Public Employees Retirement System says PBI Research Services/Berwyn Group was notified it of the breach on June 6.
The hack happened using a popular file-transfer application.
PBI says it also lost the personal data of 2.5 million Genworth Financial policyholders.
CalPERS says it will offer affected members two years of free credit monitoring.
Genworth is offering credit monitoring and ID theft protection.