The California Office of the Attorney General disclosed a data breach at Ameritas Life Insurance Corp. in July 2019, stemming from a phishing campaign that compromised employee email inboxes between May 1 and June 4, 2019. The attack exposed sensitive personal information, including names, Social Security numbers, and policy numbers of affected individuals. The breach occurred due to unauthorized access to corporate email accounts, likely exploited through deceptive phishing tactics targeting employees. While the exact number of impacted individuals was not specified in the report, the exposure of Social Security numbers—a high-value target for identity theft and fraud—elevates the severity of the incident. The company was required to notify regulatory authorities and affected parties, emphasizing the risks of financial fraud, identity misuse, and reputational harm stemming from the unauthorized access to confidential data. The incident underscores vulnerabilities in employee cybersecurity awareness and the persistent threat of phishing as an entry vector for data breaches in the insurance sector.

On March 22, 2012, Ameritas Life Insurance Corp. suffered a data breach when an employee’s laptop was stolen from a vehicle. The incident exposed sensitive personal information of unidentified individuals, including names, addresses, Social Security numbers, and dates of birth. The breach was not immediately detected and was only reported to the California Office of the Attorney General on August 3, 2012—nearly five months later. The stolen device contained unencrypted data, heightening the risk of identity theft, financial fraud, or other malicious use of the compromised information. While the exact number of affected individuals remains undisclosed, the exposure of such highly sensitive details poses significant long-term risks to those impacted, including potential credit damage, phishing attacks, or unauthorized account access. The delay in reporting further exacerbated concerns about the company’s data protection protocols and incident response capabilities.