Loading story…
Eight major car insurance companies, including American Family Mutual Insurance, State Auto Mutual Insurance, Metromile, Liberty Mutual, Hagerty Insurance Agency, Farmers Insurance, The Hartford Insurance Group, and Infinity Insurance, have been fined a total of $14.2 million by New York state regulators following significant data breaches. The breaches exposed the personal information of over 825,000 individuals, with data such as driver’s license numbers, vehicle identification numbers, and dates of birth being compromised. Hackers exploited online quote tools that were designed to auto-populate sensitive information when provided with minimal personal details, such as names or addresses. This vulnerability allowed cybercriminals to easily harvest large volumes of personal data, which was subsequently used to file fraudulent unemployment claims during the COVID-19 pandemic. Investigations by the New York Attorney General’s office revealed that the affected insurers had inadequate cybersecurity measures, failing to implement proper data security controls and monitoring systems to detect unusual access patterns. The companies were criticized for not having multifactor authentication and for lacking comprehensive data inventories. As part of the settlement, all eight insurers are required to upgrade their cybersecurity programs, install advanced monitoring systems, and implement multifactor authentication to better protect customer data. Impacted individuals are being offered one year of credit report monitoring to mitigate potential harm from the breaches. The fines and mandated improvements are intended to set a precedent for stronger cybersecurity practices within the insurance industry. The incident follows a similar enforcement action nearly a year earlier, when Geico and Travelers were fined over $11 million for comparable security failures involving auto-filled driver’s license numbers. New York officials emphasized that consumers should not have to risk their personal information when seeking insurance quotes online. The breaches highlight the risks associated with automated data population features in web applications, especially when not properly secured. Regulators have urged all insurers to review and strengthen their cybersecurity defenses to prevent future incidents. The case underscores the growing regulatory scrutiny on data protection in the financial and insurance sectors. The exposure of sensitive data on such a large scale has raised concerns about the potential for identity theft and further fraud. The enforcement action demonstrates New York’s commitment to holding companies accountable for lapses in cybersecurity that put residents at risk. Insurers are now under pressure to not only comply with regulatory requirements but also to proactively safeguard customer information against evolving cyber threats.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Alongside the fines, New York required the affected insurers to improve their cybersecurity programs, including comprehensive information security measures, stronger authentication, and better logging and monitoring. These remediation requirements were part of the state's enforcement action.
New York state announced $14.2 million in fines against eight car insurance companies after finding that quote pre-fill tool abuses exposed the personal information of more than 825,000 people. Investigators said the insurers lacked basic controls such as multifactor authentication, attack detection, and monitoring for suspicious request patterns.
In November, New York issued penalties against Geico and Travelers for similar abuses of insurance quote systems affecting about 120,000 New Yorkers in 2020. The action established an earlier enforcement step in the broader investigation into insurer pre-fill tool weaknesses.
During the COVID-19 pandemic, investigators said the data obtained through the quote-system abuse was used to submit fraudulent unemployment claims. This connected the insurer data exposures to downstream financial fraud.
In 2020, cybercriminals exploited auto-insurance quote pre-fill features by submitting minimal personal information to retrieve sensitive data such as driver's license numbers, VINs, and dates of birth. The activity exposed the personal information of hundreds of thousands of people, including about 120,000 New Yorkers in related cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026
AssuranceAmerica Managing General Agency disclosed a cyber intrusion that exposed the personal and insurance-related data of up to **6,998,886 individuals** after an unauthorized third party compromised an employee account and accessed parts of the company’s internal network. The company said the malicious activity occurred on March 16, 2026, was detected on March 17, and resulted in copied data files containing names, contact details, automobile insurance policy and account information, driver and vehicle information, and claims records. For some affected people, the exposed data may also include **driver’s license numbers**, **Social Security numbers**, and **Tax ID numbers**. AssuranceAmerica said it completed its forensic review on June 15 and began notifying affected individuals in July, after initially reporting a smaller impact before later filings raised the total to nearly 7 million. In response, the insurer took affected servers offline, isolated impacted systems, disabled compromised credentials, reset passwords, expanded monitoring and threat detection, increased employee cybersecurity training, notified law enforcement, and offered two years of identity protection and credit monitoring through IDX. The company also warned customers to watch for phishing attempts and identity-related fraud.
Jul 14, 2026
New York regulators fined Delta Dental **$2.25 million** after finding the insurer violated state cybersecurity rules in its handling of the 2023 **MOVEit Transfer** breach. Attackers linked to the **Clop** cybercrime group exploited a zero-day SQL injection flaw in Progress Software’s file transfer platform, accessed Delta Dental’s environment between **May 27 and May 30, 2023**, and exfiltrated about **60,000 files** containing sensitive personal, financial, and health information. Delta Dental said the incident affected nearly **7.1 million customers**, and breach notices offered affected individuals **24 months** of identity monitoring and identity theft protection services. The New York Department of Financial Services said Delta Dental discovered a web shell on its MOVEit servers on **June 1, 2023** but did not notify regulators until **Dec. 15, 2023**, far beyond the state’s **72-hour** reporting requirement. Investigators also found the company lacked adequate written incident response and reporting plans and had weak data retention and secure disposal practices, with some MOVEit folders retaining data longer than the platform’s default 30-day period or having retention disabled entirely. The April 29 consent order imposed the monetary penalty on Delta Dental of New York and Delta Dental Insurance and did not require additional corrective actions beyond compliance with the settlement.
Jun 29, 2026