Allianz Life, an insurance company, disclosed a significant data breach affecting approximately 1.497 million customers, employees, and financial professionals across North America. The breach occurred due to an attack on an unnamed third-party CRM provider, where unauthorized actors accessed sensitive personal data. Compromised information includes names, addresses, dates of birth, and Social Security numbers (SSNs)—highly valuable details for identity theft and fraud. The company confirmed the attackers targeted customer, staff, and financial professional records, though no immediate evidence of misuse was reported. Allianz Life responded by offering two years of identity protection and credit monitoring services to affected individuals. The breach underscores vulnerabilities in third-party vendor security, raising concerns about supply-chain risks in the financial sector.

Cybercriminals associated with the ShinyHunters, Scattered Spider, and Lapsu$ threat groups leaked 2.8 million stolen records—including names, addresses, phone numbers, dates of birth, Tax Identification Numbers, and Social Security numbers—of 1.4 million Allianz Life customers and business partners on a Telegram channel. The data was exfiltrated during a ransomware attack targeting Salesforce instances, with the attackers opting to publish the information after Allianz Life likely refused to pay or negotiations failed. The exposed details enable highly targeted phishing, identity theft, financial fraud (e.g., unauthorized loans, credit cards, tax returns), and even medical or employment fraud. The breach also heightens risks of follow-on attacks, such as wire fraud or secondary ransomware campaigns, due to the depth of personal data compromised.

Allianz Life Investigates Massive Data Breach Affecting 1.5 Million Customers Schubert Jonckheer & Kolbe LLP is examining a significant data breach at Allianz Life, a Minnesota-based life insurance provider owned by German financial services giant Allianz. The incident exposed the sensitive personal information of 1,497,036 customers, including names, addresses, dates of birth, and Social Security numbers. According to Allianz Life spokesperson Brett Weinberg, the company discovered on July 17, 2025, that a hacker had used social engineering to breach one of its cloud vendors the previous day, July 16, 2025, and exfiltrate customer data. Despite the breach occurring in mid-July, affected individuals were not notified until on or around August 1, 2025, potentially violating state and federal data breach notification laws. The delayed disclosure has raised concerns about compliance and the risk of identity theft for impacted customers. Legal action may seek financial compensation and enforce changes to Allianz Life’s cybersecurity protocols.

In July 2025, Allianz Life Insurance Company of North America suffered a cyberattack targeting a third-party cloud-based CRM system, exposing the sensitive personal data of 1.5 million individuals (1,497,036 confirmed) across the U.S. The breach, linked to the ShinyHunters extortion group, involved a social engineering campaign where attackers impersonated IT personnel to gain unauthorized remote access via Salesforce’s Data Loader tool. Compromised data includes names, addresses, dates of birth, and Social Security numbers, with 1.1 million email addresses already surfacing on the dark web (72% tied to prior breaches), heightening risks of credential stuffing, phishing, and identity theft.The company confirmed its core systems and internal networks remained unaffected, but the CRM breach enabled large-scale customer data exfiltration. Allianz Life notified the FBI, launched an investigation, and offered two years of free identity monitoring (Kroll) to victims. While no ransom demands were confirmed, the incident underscores vulnerabilities in third-party vendor security and the escalating threat of targeted extortion campaigns. Customers were advised to monitor financial accounts, enable multi-factor authentication (MFA), and consider credit freezes to mitigate fraud risks.

Allianz Life, a financial services provider, suffered a significant data breach orchestrated by the cybercrime group ShinyHunters in collaboration with Scattered Spider and Lapsus$. The attack exploited voice-based social engineering (vishing), where criminals impersonated IT helpdesk personnel to trick employees into divulging credentials and multi-factor authentication (MFA) codes. The breach resulted in the public exposure of 2.8 million records, including sensitive customer and corporate partner data hosted on Salesforce, a customer management platform. The leaked data likely included personal and financial details, exposing individuals to risks such as identity theft, fraud, and reputational harm. ShinyHunters publicly released the data on Telegram before the channel was shut down, amplifying the incident’s visibility. The group’s shift to ransomware-as-a-service (RaaS)—partnering with other threat actors—suggests escalating tactics, increasing the potential for future extortion or secondary attacks. Allianz Life’s breach underscores vulnerabilities in third-party cloud providers and the growing sophistication of AI-driven social engineering, where deepfake voice cloning evades traditional detection methods. The incident erodes trust in the company’s data security practices and may trigger regulatory scrutiny, financial penalties, or customer attrition.

Allianz Life Insurance experienced a significant data breach in early 2024, exposing the sensitive personal information of approximately 1.5 million customers. The incident involved unauthorized access to customer data, though the exact nature of the compromised information (e.g., financial records, Social Security numbers, or medical details) was not fully disclosed. Such breaches typically heighten risks of identity theft, financial fraud, and reputational damage for affected individuals. The scale of the breach—affecting over a million people—suggests systemic vulnerabilities in Allianz’s data security protocols. While the company likely initiated containment measures, the long-term consequences for customer trust and regulatory compliance (e.g., potential GDPR or state-level penalties) remain critical concerns. The breach underscores the growing threat landscape for insurance providers, which hold vast repositories of high-value personal data.

On December 10, 2024, the Maine Office of the Attorney General reported a data breach involving Allianz Life Insurance Company of North America. The breach, which occurred on April 15, 2024, resulted in the inadvertent disclosure of information affecting 597 individuals, including 17 residents. Allianz Life has offered one year of identity monitoring services provided by Kroll.