Farmers Insurance suffered a data breach linked to a third-party hack at Salesforce, compromising over 1 million customers’ sensitive information, including names, addresses, birth dates, and driver’s licenses. Among the affected were agricultural producers, whose personal and operational data were exposed. The breach fueled follow-on phishing scams, exploiting the stolen data to trick victims into revealing further credentials or financial details. While the attack did not involve ransomware, the exposure of personally identifiable information (PII)—critical for farm operations, loan applications, and subsidy eligibility—posed severe risks of identity theft, financial fraud, and reputational damage. The incident underscored vulnerabilities in rural sectors, where reliance on third-party platforms (like Salesforce) and shared email systems heightens exposure. No evidence suggested the breach directly disrupted farm operations, but the leak of customer data—including ag producers—aligned with broader trends targeting the industry’s digital dependencies.

A data breach at Farmers Insurance, discovered via a third-party vendor, exposed the personal information of over 1.07 million customers. The incident occurred on May 29–30, 2025, when an unauthorized actor accessed a vendor’s database containing Farmers’ customer records. The compromised data included names, addresses, dates of birth, driver’s license numbers, and the last four digits of Social Security numbers. The breach was detected through monitoring tools, prompting containment measures, including blocking unauthorized access. Farmers launched an investigation, confirming on July 24, 2025, that customer data had been accessed and acquired. Affected individuals were notified starting August 22, 2025, with offers of 24 months of free credit monitoring and identity protection services. While no evidence suggested further data exposure, the breach highlights vulnerabilities in third-party vendor security, raising concerns over potential identity theft or fraud for impacted policyholders. The incident aligns with a broader trend of cyber threats targeting U.S. insurers in 2025.

The California Office of the Attorney General reported that Farmers Insurance experienced a data breach between January 20, 2021, and February 12, 2021, potentially exposing personal information such as names, addresses, dates of birth, and driver's license numbers. The breach was reported on May 4, 2021.

The California Office of the Attorney General disclosed a data breach affecting Farmers Insurance, which transpired on March 31, 2019, but was reported later on December 3, 2019. The incident involved unauthorized access to sensitive customer data, including names, Social Security numbers, and medical history. While the precise number of impacted individuals remains undisclosed, the exposure of such highly personal information poses severe risks, including identity theft, financial fraud, and privacy violations. The breach underscores vulnerabilities in Farmers Insurance’s data protection measures, potentially eroding customer trust and triggering regulatory scrutiny. Given the nature of the compromised data—particularly medical records and Social Security numbers—the long-term repercussions for affected individuals could be substantial, ranging from targeted phishing attacks to fraudulent credit applications. The delay in public disclosure further compounds concerns about transparency and incident response protocols within the organization.

The New York Department of Financial Services (DFS) fined Farmers Insurance Exchange $2.8 million for inadequate cybersecurity controls that exposed consumer data—including driver’s license numbers and birth dates—through vulnerable online quoting platforms. The breach stemmed from systemic failures in safeguarding sensitive personal information, compounded by the company’s delay in reporting the incident, which further undermined consumer protections. DFS mandated remedial measures, including a comprehensive review of data storage and access protocols, to prevent future exposures. The enforcement action highlights regulatory scrutiny under New York’s cybersecurity framework (enacted in 2017, updated in 2023), which serves as a benchmark for financial sector oversight. While Farmers Insurance acknowledged the penalties, the case remains part of an ongoing DFS investigation into broader industry vulnerabilities. The incident underscores the risks of unsecured digital platforms in handling high-value consumer data, particularly in sectors like auto insurance where personally identifiable information (PII) is routinely processed.