Loading story…
Allianz Life Insurance Company of North America suffered a significant data breach in July 2025, impacting approximately 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to a third-party cloud-based Customer Relationship Management (CRM) system, specifically a Salesforce instance, used by Allianz Life’s U.S. operations. Attackers gained access to the CRM on July 16, 2025, by employing social engineering tactics, impersonating IT helpdesk staff to deceive an employee into granting access. Once inside the CRM environment, the threat actors utilized Salesforce’s Data Loader tool to rapidly extract sensitive data. The compromised information included full names, mailing and email addresses, dates of birth, Social Security numbers, phone numbers, and insurance policy details. The exposure of Social Security numbers heightened the risk of identity theft and fraud for those affected. Allianz Life detected the breach the following day and immediately notified federal authorities, including the FBI, and began an internal investigation. The company emphasized that there was no evidence of unauthorized access to its internal network or critical systems, such as its policy administration system. Allianz Life started notifying affected individuals on August 1, 2025, and offered two years of complimentary identity theft monitoring and credit restoration services through Kroll. Dedicated support channels were established to assist impacted customers and professionals. The breach is believed to be linked to the ShinyHunters hacking group, which, along with other groups like Scattered Spider and Lapsus$, claimed responsibility and leaked databases stolen from Allianz Life’s Salesforce instances. The leaked files reportedly included Salesforce “Accounts” and “Contacts” tables, containing about 2.8 million records of individual customers and businesses. The incident underscores the growing risks associated with third-party service providers and the importance of robust security controls and employee awareness training. Allianz Life’s swift response and cooperation with law enforcement aimed to mitigate the impact and prevent further exploitation of the stolen data. The investigation into the full scope and attribution of the breach remains ongoing. The company has not confirmed the exact number of affected individuals, but external sources estimate the impact to be between 1.1 and 1.5 million people. The breach has drawn attention to the need for enhanced monitoring of cloud-based platforms and the criticality of rapid incident detection and response. Allianz Life’s transparency and support measures have been commended, but the long-term consequences for affected individuals and the company’s reputation are still unfolding.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On October 2, 2025, Allianz Life publicly disclosed the July breach, and a notice filed with the Maine Attorney General's Office said 1,497,036 individuals were affected in its North America branch. The company also began notifying affected individuals and offered two years of free Kroll identity monitoring.
Reporting indicated the incident may be linked to ShinyHunters, and threat actors claimed to have leaked databases from Allianz Life Salesforce instances containing millions of records. This public claim connected the breach to a known threat actor and suggested large-scale data exposure.
After discovering the breach, Allianz Life said it contained and mitigated the incident and notified the FBI. The company stated its investigation into the intrusion remained ongoing.
In July 2025, Allianz Life said a threat actor used social engineering to gain access to a third-party cloud CRM system and steal sensitive personal data. The company said there was no evidence its internal network or critical systems, including policy administration, were accessed.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethecyberthrone.in
Open sourceforbes.com
Open sourcecyber.nj.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Figure and Allianz Life disclosed separate breaches in which attackers used **social engineering** to gain access to systems holding large volumes of customer data. Figure said an employee was deceived into granting access, leading to the public posting of a dataset from January 2026 that contained more than **900,000 unique email addresses** as well as names, phone numbers, physical addresses, and dates of birth. Allianz Life reported that a cyberattack in July 2025 targeted data stored on **Salesforce** and was later followed by the online leak of **1.1 million unique email addresses**. The exposed Allianz Life records also included names, genders, dates of birth, phone numbers, and physical addresses, underscoring how social engineering attacks continue to drive large-scale exposure of sensitive personal information across financial services firms.
Jun 29, 2026
Allianz Life and WestJet have both confirmed significant data breaches impacting a combined total of approximately 3.7 million customers and employees across North America. Allianz Life, an insurance company, reported that the personal data of about 1.5 million individuals was compromised following a security incident at an unnamed third-party customer relationship management (CRM) provider. The exposed information includes names, addresses, dates of birth, and Social Security numbers belonging to customers, staff, and financial professionals associated with Allianz. The company notified affected individuals through letters and reported the incident to the Maine Attorney General's Office, emphasizing the breadth of the data accessed. In parallel, Canadian airline WestJet disclosed that a cyberattack in June, allegedly carried out by the Scattered Spider group, resulted in the exposure of data for 1.2 million Americans. The breach affected WestJet’s online services and mobile app, prompting the airline to urge customers and staff to exercise additional caution. The compromised data at WestJet may include names, contact details, reservation information, and documents related to travel, though the airline assured that credit card numbers, CVV codes, and user passwords were not affected. WestJet also stated that the safety and integrity of its operations were never at risk during the incident. Both companies have faced scrutiny over the handling of sensitive personal information and the adequacy of their security measures, particularly in the context of third-party service providers. The incidents highlight the persistent risks associated with supply chain vulnerabilities and the growing trend of attackers targeting service providers to access large volumes of data. Regulatory authorities, such as the FTC and state attorneys general, are closely monitoring these breaches, and affected organizations are under pressure to improve their incident response and notification processes. The breaches underscore the importance of robust third-party risk management and the need for organizations to maintain transparency with customers following security incidents. As the number of large-scale data breaches continues to rise, these cases serve as a reminder of the critical need for comprehensive cybersecurity strategies and proactive defense measures across all sectors.
Jun 29, 2026
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026